Total
20000 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-56068 | 2026-06-29 | N/A | 9.3 CRITICAL | ||
| Unauthenticated SQL Injection in JetEngine <= 3.8.10.2 versions. | |||||
| CVE-2026-12050 | 1 Pgadmin | 1 Pgadmin 4 | 2026-06-29 | N/A | 4.3 MEDIUM |
| SQL injection in pgAdmin 4's named restore point endpoint (POST /browser/server/restore_point/{gid}/{sid}). The user-supplied 'value' field was interpolated directly into the SQL string with str.format() instead of being passed as a bound parameter, allowing an authenticated pgAdmin user with a connected PostgreSQL session to inject additional statements through that endpoint. The injected SQL executes under the database role the user is already authenticated as. The defect does not cross a privilege boundary -- the user already has direct SQL access to that role through the Query Tool -- so the attacker gains no capability beyond what their database role already grants them. The marginal impact accounts for the fact that the injection path is not the documented SQL-execution interface, so a deployment that gates the Query Tool at the application layer could see SQL executed through a path it did not anticipate. Fix passes the restore point name as a bound parameter and schema-qualifies the function call as pg_catalog.pg_create_restore_point so a non-default search_path on the connection cannot redirect the call to a shadow definition. A regression test asserts the value arrives as a bound parameter and not spliced into the SQL string. This issue affects pgAdmin 4: from 1.0 before 9.16. | |||||
| CVE-2026-57643 | 2026-06-26 | N/A | 8.5 HIGH | ||
| Contributor SQL Injection in WP Post Author <= 3.9.1 versions. | |||||
| CVE-2026-57636 | 2026-06-26 | N/A | 8.5 HIGH | ||
| Contributor SQL Injection in wpForo Forum <= 3.0.9 versions. | |||||
| CVE-2026-56062 | 2026-06-26 | N/A | 9.3 CRITICAL | ||
| Unauthenticated SQL Injection in Quotes llama <= 3.1.5 versions. | |||||
| CVE-2026-54827 | 2026-06-26 | N/A | 9.3 CRITICAL | ||
| Unauthenticated SQL Injection in Real Estate 7 <= 3.5.9 versions. | |||||
| CVE-2026-39951 | 1 Cacti | 1 Cacti | 2026-06-26 | N/A | 7.6 HIGH |
| Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have a Stored SQL Injection vulnerability through graph_name_regexp in the Reports feature. This issue has been fixed in version 1.2.31. | |||||
| CVE-2026-44271 | 1 Dell | 1 Wyse Management Suite | 2026-06-26 | N/A | 8.1 HIGH |
| Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access. | |||||
| CVE-2026-44272 | 1 Dell | 1 Wyse Management Suite | 2026-06-26 | N/A | 8.8 HIGH |
| Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access. | |||||
| CVE-2026-57663 | 2026-06-26 | N/A | 8.5 HIGH | ||
| Contributor SQL Injection in Recipe Maker For Your Food Blog from Zip Recipes <= 8.2.7 versions. | |||||
| CVE-2026-57631 | 2026-06-26 | N/A | 7.6 HIGH | ||
| Administrator SQL Injection in Popup box <= 6.0.1 versions. | |||||
| CVE-2026-56070 | 2026-06-26 | N/A | 9.3 CRITICAL | ||
| Unauthenticated SQL Injection in Advance Product Search <= 1.4.4 versions. | |||||
| CVE-2026-56064 | 2026-06-26 | N/A | 8.5 HIGH | ||
| Subscriber SQL Injection in Tourfic <= 2.22.5 versions. | |||||
| CVE-2026-56036 | 2026-06-26 | N/A | 9.3 CRITICAL | ||
| Unauthenticated SQL Injection in 워드프레스 결제 심플페이 <= 5.5.6 versions. | |||||
| CVE-2026-54831 | 2026-06-26 | N/A | 9.3 CRITICAL | ||
| Unauthenticated SQL Injection in GeoDirectory <= 2.8.162 versions. | |||||
| CVE-2026-54820 | 2026-06-26 | N/A | 9.3 CRITICAL | ||
| Unauthenticated SQL Injection in JetBooking <= 4.0.4.1 versions. | |||||
| CVE-2026-57662 | 2026-06-26 | N/A | 8.5 HIGH | ||
| Contributor SQL Injection in Contest Gallery <= 30.0.0 versions. | |||||
| CVE-2026-57644 | 2026-06-26 | N/A | 8.5 HIGH | ||
| Contributor SQL Injection in Restaurant Menu by MotoPress <= 2.4.10 versions. | |||||
| CVE-2025-26988 | 1 Cozyvision | 1 Sms Alert Order Notifications | 2026-06-26 | N/A | 9.3 CRITICAL |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allows SQL Injection.This issue affects SMS Alert Order Notifications: from n/a through <= 3.7.8. | |||||
| CVE-2026-57588 | 1 Tenable | 1 Nessus | 2026-06-26 | N/A | 3.3 LOW |
| A SQL injection vulnerability in Nessus allows an attacker to craft a malicious scan result file that, when imported by a privileged user, injects malicious SQL into the scan results database, potentially enabling exfiltration of scan-result data. | |||||