Total
20690 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-73721 | 1 Arubanetworks | 1 Fabric Composer | 2026-09-02 | N/A | 7.2 HIGH |
| Vulnerabilities in the API of HPE Networking Fabric Composer could allow an authenticated remote attacker to conduct SQL injection attacks against the HPE Networking Fabric Composer instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database potentially leading to complete compromise of the HPE Networking Fabric Composer host. | |||||
| CVE-2026-81756 | 2026-09-02 | N/A | 9.3 CRITICAL | ||
| Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms <= 5.1.24 versions. | |||||
| CVE-2026-49809 | 1 Dell | 1 Powerprotect Cyber Recovery | 2026-09-02 | N/A | 6.5 MEDIUM |
| Dell PowerProtect Cyber Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure. | |||||
| CVE-2026-82701 | 2026-09-02 | 7.5 HIGH | 7.3 HIGH | ||
| A vulnerability was determined in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /action.php of the component Search Functionality. This manipulation of the argument keyword causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. | |||||
| CVE-2026-82696 | 2026-09-02 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A weakness has been identified in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/inv_searchfrm.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. | |||||
| CVE-2025-54790 | 1 Humhub | 1 Files | 2026-09-02 | N/A | 6.5 MEDIUM |
| Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, Files does not have logic to prevent the exploitation of backend SQL queries without direct output, potentially allowing unauthorized data access. This is fixed in version 0.16.10. | |||||
| CVE-2026-3627 | 2 Ibm, Linux | 2 Concert, Linux Kernel | 2026-09-02 | N/A | 9.1 CRITICAL |
| IBM Concert 1.0.0 through 2.3.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database. | |||||
| CVE-2026-78317 | 2026-09-01 | N/A | 8.8 HIGH | ||
| SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution. | |||||
| CVE-2026-78316 | 2026-09-01 | N/A | 8.8 HIGH | ||
| SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution. | |||||
| CVE-2026-78315 | 2026-09-01 | N/A | 8.8 HIGH | ||
| SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution. | |||||
| CVE-2026-78314 | 2026-09-01 | N/A | 8.8 HIGH | ||
| SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution. | |||||
| CVE-2026-18630 | 2026-09-01 | N/A | 8.8 HIGH | ||
| Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows SQL Injection. This issue affects Talassoft Industrial Management Software: from V.4 before V.16. | |||||
| CVE-2026-59109 | 2026-09-01 | N/A | 8.8 HIGH | ||
| SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in received electronic invoices. When importing a received e-invoice (UBL/PEPPOL) or an e-commerce export, Zalktis concatenates partner-controlled values directly into SQL statement text using string concatenation, with neither parameterised queries nor escaping. The application's own escaping helper, Dazadi.sql_txt(), is not invoked on these code paths, so a party that sends an invoice can break out of the string literal and alter the query logic. This issue affects Zalktis: before 2026.1.586 and before 2026.2.592. | |||||
| CVE-2026-74820 | 2026-09-01 | N/A | N/A | ||
| ServiceNow has remediated a SQL injection vulnerability that was identified in in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gain access to, or modify, instance data beyond what was intended. ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so. | |||||
| CVE-2026-81763 | 2026-09-01 | N/A | 9.3 CRITICAL | ||
| Unauthenticated SQL Injection in Throws SPAM Away <= 3.8.2 versions. | |||||
| CVE-2026-81293 | 2026-09-01 | N/A | 9.3 CRITICAL | ||
| Unauthenticated SQL Injection in WP Data Access <= 5.5.81 versions. | |||||
| CVE-2026-82914 | 2026-09-01 | 7.5 HIGH | 7.3 HIGH | ||
| A security flaw has been discovered in kishan0725 Hospital-Management-System 1.0. This vulnerability affects unknown code of the file /search.php. The manipulation of the argument Contact results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-81287 | 2026-09-01 | N/A | 8.5 HIGH | ||
| Subscriber SQL Injection in Charitable <= 1.8.12.1 versions. | |||||
| CVE-2026-84109 | 2026-09-01 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6. Affected by this issue is the function getOrder of the file webmain/webmainAction.php. Executing a manipulation of the argument highorder can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-77823 | 2026-09-01 | N/A | 4.9 MEDIUM | ||
| The LearnPress plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the export_order_csv AJAX action in versions up to, and including, 4.4.4. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the LP_Order::handle_params_query_list_orders() and DataBase::execute() functions — only the literal values 'date' and 'title' are normalized, while any other attacker-controlled string is assigned directly to the filter's order_by property and concatenated into the ORDER BY clause without $wpdb->prepare() or an identifier whitelist. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | |||||