Export limit exceeded: 20987 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (20987 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-93426 | 1 Signoz | 1 Signoz | 2026-09-18 | 8.5 High |
| SigNoz versions 0.87.0 before 0.142.0 fail to escape user-supplied telemetry field-key names in the v5 query_range API, allowing authenticated users to inject SQL. Attackers with Viewer role or higher can embed backticks and quotes in field names to break out of identifiers and string literals, executing arbitrary ClickHouse SQL to read system tables and exfiltrate data. | ||||
| CVE-2026-81626 | 1 Ibm | 1 Guardium Data Protection | 2026-09-18 | 8.6 High |
| IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Load Balancer Groups component. An unauthenticated user can inject SQL statements through the Load Balancer Servlet endpoint, potentially resulting in unauthorized access to data and impact to the confidentiality, integrity, and availability of the affected system. | ||||
| CVE-2026-53556 | 1 Dataease | 1 Sqlbot | 2026-09-18 | N/A |
| SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/previewData endpoint in backend/apps/datasource/crud/datasource.py incorporates the client-controlled table_name value into generated SQL without safe identifier handling. An authenticated user can configure a datasource for SQLBot's internal PostgreSQL service and submit a crafted table_name that remains a SELECT operation under the read-only policy while invoking pg_read_file(), pg_read_binary_file(), or pg_ls_dir(). In the default tested trusted loopback authentication configuration, the internal connection accepts invalid credentials and executes with PostgreSQL superuser privileges, allowing filesystem content such as /etc/hosts and /etc/passwd to be returned in the previewData API response and potentially exposing configuration, credentials, authentication secrets, and source code. This issue is fixed in version 1.9.0. | ||||
| CVE-2026-66624 | 2 Ludwig You, Wordpress | 2 Wpmastertoolkit, Wordpress | 2026-09-18 | 7.6 High |
| Administrator SQL Injection in WPMasterToolKit <= 2.22.0 versions. | ||||
| CVE-2026-54646 | 1 Cubecart | 1 V6 | 2026-09-18 | 7.2 High |
| CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablename values into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE statements without validating the identifiers or escaping embedded backticks. An authenticated administrator can terminate the quoted identifier with a closing backtick and introduce attacker-controlled structural SQL, potentially compromising database confidentiality, integrity, and availability within the application's database privileges. This issue is fixed in version 6.7.5. | ||||
| CVE-2026-75746 | 1 Adobe | 3 Coldfusion, Coldfusion 2023, Coldfusion 2025 | 2026-09-18 | 9.1 Critical |
| ColdFusion is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. | ||||
| CVE-2026-54524 | 1 Frappe | 1 Hrms | 2026-09-18 | N/A |
| Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.7.0, an authenticated user with the HR User role can inject SQL through filters in the Salary Payments Based on Payment Mode report. In hrms/payroll/report/salary_payments_based_on_payment_mode/salary_payments_based_on_payment_mode.py, get_conditions constructs filter clauses from user-controlled values and get_data incorporates those clauses into a string-formatted SQL query, allowing extraction of arbitrary database data. This issue is fixed in 16.7.0. | ||||
| CVE-2026-52851 | 1 Traccar | 1 Traccar | 2026-09-18 | 7.1 High |
| Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated, non-readonly user with access to an object usable in a permission pair can submit DELETE /api/permissions with an extra attacker-controlled JSON key. Permission(LinkedHashMap<String, Long>) in src/main/java/org/traccar/model/Permission.java validates only the first two keys, but DatabaseStorage.removePermission() in src/main/java/org/traccar/storage/DatabaseStorage.java concatenates every map key into the SQL WHERE clause as a column identifier. The extra key therefore becomes attacker-controlled SQL and provides a blind boolean or error oracle that can extract arbitrary database values, including administrator email, password hashes, and salts, or conditionally delete permission rows. Unauthenticated requests are rejected. This issue is fixed in 6.14.0. | ||||
| CVE-2026-92903 | 1 Snowflake | 1 Snowflake Cli | 2026-09-18 | 8.2 High |
| Improper input validation in Snowflake CLI versions prior to 3.27.0 allowed unsanitized user-controlled values to be interpolated into SQL strings that are executed as multi-statement queries. An attacker who is able to supply a malicious project configuration file or craft command-line input can cause Snowflake CLI to execute attacker-controlled SQL statements in the context of the victim's Snowflake session and active role. Successful exploitation requires either write or pull-request access to a project repository whose CI/CD pipeline runs Snowflake CLI under an elevated service account role, or the ability to supply untrusted input to CLI-wrapping automation. Impact is limited by the privileges held by the configured Snowflake role at execution time. The fix is available in Snowflake CLI version 3.27.0, which also addresses several additional security findings. Users must manually upgrade. | ||||
| CVE-2026-86865 | 1 Tanium | 1 Asset | 2026-09-18 | 7.2 High |
| Tanium addressed a SQL injection vulnerability in Asset. | ||||
| CVE-2026-84859 | 1 Scada-lts | 1 Scada-lts | 2026-09-18 | 6.5 Medium |
| ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Blind SQL Injection The /api/events/search endpoint accepts a JSON body containing a sortBy array. The values in this array are concatenated directly into the SQL ORDER BY clause without any sanitization or parameterization. This allows authenticated users with the ROLE_USER role to perform time-based and boolean-based blind SQL injection to extract arbitrary data from the database, including password hashes of all users. The endpoint is accessible to any authenticated user with ROLE_USER, ROLE_ADMIN, or ROLE_PUBLIC via POST /api/events/search as defined in spring-security.xml. | ||||
| CVE-2026-84993 | 1 Mikro-orm | 1 Mikro-orm | 2026-09-18 | 6.5 Medium |
| MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to 6.6.16 and 7.1.7, the shared SQL layer validates the field key of an orderBy clause but does not validate its direction value before AbstractSqlPlatform.getOrderByExpression concatenates it into an ORDER BY clause. Applications that bind attacker-controlled request data to the direction in em.find(), em.findOne(), em.findAndCount(), QueryBuilder.orderBy(), or QueryBuilderHelper.getQueryOrderFromObject() can permit a raw SQL fragment that performs blind or boolean extraction of data available to the database account. The BaseMySqlPlatform and MsSqlPlatform fallthrough paths have the same behavior, affecting SQLite, PostgreSQL, MySQL, MariaDB, MSSQL, libSQL, and Oracle drivers, while MongoDB is not affected. This issue is fixed in versions 6.6.16 and 7.1.7. | ||||
| CVE-2026-87105 | 1 Tanium | 1 Threat Response | 2026-09-18 | 8.8 High |
| Tanium addressed a SQL injection vulnerability in Threat Response. | ||||
| CVE-2026-87024 | 1 Tanium | 1 Asset | 2026-09-18 | 7.2 High |
| Tanium addressed a SQL injection vulnerability in Asset. | ||||
| CVE-2026-66580 | 2 Rextheme, Wordpress | 2 Product Feed Manager, Wordpress | 2026-09-17 | 8.5 High |
| Contributor SQL Injection in Product Feed Manager <= 7.12.0 versions. | ||||
| CVE-2026-66625 | 2 Wcvendors, Wordpress | 2 Wc Vendors Marketplace, Wordpress | 2026-09-17 | 7.6 High |
| Administrator SQL Injection in WC Vendors Marketplace <= 2.7.2.1 versions. | ||||
| CVE-2026-76461 | 1 Cisco | 8 Asyncos, Secure Email, Secure Email Gateway C195 and 5 more | 2026-09-17 | 9.8 Critical |
| A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system. | ||||
| CVE-2026-92465 | 2 Themehunk, Wordpress | 2 Mega Menu, Wordpress | 2026-09-17 | 7.6 High |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum WP Mega Menu allows Blind SQL Injection. This issue affects WP Mega Menu: from n/a through 1.4.2. | ||||
| CVE-2026-66628 | 2 Wordpress, Wplab | 2 Wordpress, Wp-lister Lite For Ebay | 2026-09-17 | 7.6 High |
| Shop manager SQL Injection in WP-Lister Lite for eBay <= 3.8.11 versions. | ||||
| CVE-2026-92926 | 1 Code-projects | 1 Matrimonial System | 2026-09-17 | 7.3 High |
| A vulnerability has been found in code-projects Matrimonial System 1.0. This vulnerability affects the function writepartnerprefs of the file /partner_preference.php. Such manipulation of the argument education leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. | ||||