CVE-2026-78614 is an authenticated SQL injection vulnerability in WatchGuard Dimension's audit report feature. It allows an authenticated user with report administration permissions to execute arbitrary commands as the Dimension WebUI process user by sending specially crafted requests. The vulnerability affects version 2.0 of WatchGuard Dimension. The CVSS 4.0 base score is 8.6, indicating high severity.
CVE-2026-81677 is a high-severity SQL injection vulnerability in the TOOOLS iSquad product. The vulnerability exists in the '/ws/apiprensa/getVideo' endpoint, where the GET parameter 'id_ambito' is improperly validated. This allows an attacker to inject SQL syntax that disrupts the MariaDB query structure and causes database error messages to be exposed via PDOException. The flaw arises from incorporating user input directly into SQL statements without proper sanitization or prepared statements.
CVE-2026-81676 is a high-severity SQL injection vulnerability in TOOOLS iSquad affecting the endpoint '/ws/apitribuna/ultimosVideos'. The 'limit_videos' parameter is concatenated directly into a MariaDB SQL query without proper sanitization, allowing remote attackers to inject SQL syntax. This results in error-based SQL injection that exposes internal database error messages and stack traces, revealing backend implementation details.
CVE-2026-81675 is a critical SQL injection vulnerability in the TOOOLS iSquad product. The flaw exists in the '/ws/apiprensa/getVideoUltimasSeccion' endpoint, specifically in the 'id_seccion' parameter, which is directly embedded in a complex SQL query. This allows an attacker to inject SQL syntax, disrupt query structure, and cause database errors that expose internal query logic. The complexity of the query increases the potential impact by enabling broader manipulation of content retrieval.
CVE-2026-81674 is a critical SQL injection vulnerability in TOOOLS iSquad affecting the endpoint '/ws/apiprensa/getVideoNextPrev' via the id_ambito parameter. Unsanitized input is directly used in a MariaDB query, causing detailed database error messages that reveal internal query structure and potentially aid attackers. No patch or official remediation is currently confirmed.
CVE-2026-81673 is a critical SQL injection vulnerability in the TOOOLS iSquad product. The vulnerability exists in the '/ws/apitribuna/setVisita' endpoint, where the id_video and id_ambito parameters are not properly validated or sanitized. This allows remote attackers to inject malicious SQL commands, potentially disrupting database queries and manipulating visit tracking records. The flaw could impact the integrity of analytics and the accuracy of stored records.
CVE-2026-81672 is a critical SQL injection vulnerability in TOOOLS iSquad affecting the '/ws/apiprensa/getVideoSubcanal' endpoint. The vulnerability arises from improper sanitization of the 'id_video' parameter, allowing malicious input to cause SQL execution errors. Additionally, the Slim framework’s error handler exposes internal file paths and full stack traces, increasing the risk by combining SQL injection with information disclosure.
CVE-2026-81277 is a high-severity SQL Injection vulnerability in VillaTheme Suggestion Engine for WooCommerce versions up to 2.0.11. It allows an attacker with low privileges to execute SQL commands due to improper neutralization of special elements in SQL queries. This vulnerability can lead to high confidentiality impact and low availability impact but does not affect integrity. No official patch or remediation guidance is currently available.
CVE-2026-78288 is a critical unauthenticated SQL Injection vulnerability affecting Beautiful Taxonomy Filters versions up to 2.4.6. This flaw allows remote attackers to execute SQL commands without authentication, potentially leading to high confidentiality impact and limited availability impact. No official patch or remediation guidance is currently confirmed from the vendor.
CVE-2026-78285 is a high-severity SQL Injection vulnerability affecting Like Button Rating versions up to and including 2.6.61. It allows an attacker with limited privileges to execute unauthorized SQL commands, potentially leading to high confidentiality impact and limited availability impact. No official patch or remediation guidance has been provided yet.
CVE-2026-32564 is a high severity SQL Injection vulnerability in the ACPT (Pro) - Custom Post Types Plugin for WordPress affecting versions up to 2.0.63. The flaw allows an attacker with low privileges to execute unauthorized SQL commands due to improper neutralization of special elements in SQL queries. This vulnerability can lead to a partial compromise of data confidentiality and availability. No official patch or remediation guidance is currently available from the vendor.
CVE-2026-32550 is a high severity SQL Injection vulnerability affecting Kadence Shop Kit versions up to 3.0.6. It allows an attacker with low privileges and no user interaction to cause a partial denial of service and potentially gain high confidentiality impact via improper neutralization of special elements in SQL commands.
CVE-2026-32479 is a critical unauthenticated SQL Injection vulnerability in Visitor Traffic Real Time Statistics Pro versions up to and including 11.17. This flaw allows an attacker to inject malicious SQL commands without authentication, potentially leading to high confidentiality impact and limited availability impact. No official patch or remediation guidance is currently available from the vendor.
SourceCodester Simple Online Food Ordering System version 1.0 contains a SQL injection vulnerability in the /admin/ajax.php?action=login2 endpoint. The vulnerability arises from improper handling of the 'email' parameter, allowing remote attackers to inject SQL commands. This flaw has been publicly disclosed, but no official patch or fix has been provided yet.
Dell PowerProtect Cyber Recovery versions 20.2 and earlier contain an SQL Injection vulnerability that allows a low privileged remote attacker to potentially disclose information. The vulnerability involves improper neutralization of special elements in SQL commands. It has a medium severity score of 6.5 and does not currently have an official fix or patch available.
CVE-2026-47834 is a medium severity vulnerability in Spring Data JPA involving improper neutralization of special elements in SQL commands, specifically an SQL injection risk. The issue arises because the Sort validation can be bypassed when parameters containing crafted payloads are accepted from untrusted sources. This affects multiple versions of Spring Data JPA including 3.0.0 through 3.4.15, 3.5.0 through 3.5.13, 4.0.0 through 4.0.6, and exactly 4.1.0. The vulnerability has a CVSS score of 4.8 and does not currently have an official patch or remediation level indicated. No known exploits in the wild have been reported.
Fleet versions prior to 4.86.2 with Fleet Premium and Okta conditional access integration enabled are vulnerable to SQL injection. The vulnerability arises from improper parameterization of a host-supplied value used in a database query. An attacker controlling a single enrolled host can exploit this to read or modify arbitrary data in the Fleet database, potentially extracting session tokens and gaining global administrator access. This access can lead to remote code execution on enrolled hosts. The vulnerability does not affect Fleet instances without the Okta conditional access integration configured. The issue is fixed in version 4.86.2.
CVE-2026-46371 is a SQL injection vulnerability in fleetdm fleet versions up to 4.84.1. It affects the Apple MDM commands listing endpoint, allowing an authenticated user with Observer role to extract sensitive data from joined database tables via a sort-order oracle attack. This includes host enrollment secrets and Apple Push Notification Service tokens. The flaw arises because the order_key parameter is not validated against an allowlist, enabling binary search extraction of sensitive values. With extracted keys, attackers can impersonate enrolled hosts and interact with Fleet's osquery and Orbit endpoints. The issue is fixed in version 4.84.2.
Fleet versions up to 4.84.1 have a SQL injection vulnerability in the labels host-listing endpoint that allows authenticated users with Observer role to extract host enrollment secrets. This flaw enables attackers to reconstruct long-lived shared secrets used for agent authentication, potentially impersonating hosts and manipulating device management data. The issue is fixed in version 4.84.2.
Winter CMS versions up to 1.2.12 contain a SQL injection vulnerability in the backend Filter widget's numberrange scope when configured with a conditions key. This flaw allows an authenticated backend user to inject arbitrary SQL via the filter's AJAX handler, potentially reading arbitrary database contents. Exploitation requires a third-party plugin that registers this specific filter scope configuration, as no default backend views use it. The issue is resolved in version 1.2.13.