Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and several LTS releases contain a SQL Injection vulnerability (CWE-89). This flaw allows a high privileged remote attacker to potentially disclose information. The vulnerability has a low CVSS score of 2.7 and does not impact integrity or availability. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0 depending on the release line.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and certain LTS releases contain an SQL Injection vulnerability (CWE-89). This flaw allows a high privileged remote attacker to potentially disclose information. The vulnerability has a low CVSS score of 2.7 and does not impact integrity or availability. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and several LTS releases contain an SQL Injection vulnerability (CWE-89). A high privileged attacker with remote access could exploit this flaw to disclose information. The vulnerability has a low CVSS score of 2.7 and does not impact integrity or availability. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0.
The WP Inventory Manager plugin for WordPress contains a time-based SQL Injection vulnerability in the 'sort_order' shortcode attribute. This affects all versions up to and including 2.5.5. Authenticated users with contributor-level access or higher can exploit this flaw by embedding the vulnerable shortcode in a draft post preview, allowing them to extract sensitive database information without publishing the post.
The VikRentCar Car Rental Management System WordPress plugin is vulnerable to blind SQL Injection via the 'catid' parameter in versions up to and including 1.4.10. Authenticated users with contributor-level access or higher can exploit this flaw by injecting SQL through a malicious block stored via the REST API in a pending post and triggering server-side rendering. This bypasses standard input sanitization mechanisms, allowing extraction of sensitive database information.
The WP Visitor Statistics (Real Time Traffic) WordPress plugin up to version 8.8 contains a SQL Injection vulnerability in the shortcode attributes 'from', 'to', 'first', and 'second' of the [wsm_showTrafficStatsList] shortcode. Authenticated users with Contributor-level access or higher can exploit this flaw to inject arbitrary SQL commands due to insufficient sanitization of user input before it is concatenated into SQL queries.
CVE-2026-115281 is a SQL injection vulnerability in the Recipe Card Blocks Lite WordPress plugin versions 3.5.0 up to but not including 3.6.4. It arises because the plugin fails to properly sanitize and cast block and shortcode attributes before including them in SQL queries. This flaw allows authenticated users with Contributor-level access or higher to perform SQL injection attacks. The vulnerability has a CVSS score of 6.8 (medium severity) and was fixed in version 3.6.4.
CVE-2026-115224 is a SQL Injection vulnerability in the Customer Engagement System WordPress plugin versions before 2.0.2. It occurs because the plugin improperly constructs SQL INSERT statements by concatenating administrator-supplied ID values without parameter binding or integer casting. This flaw allows an authenticated administrator to inject arbitrary SQL and read the WordPress database contents.
CVE-2026-111027 is a SQL injection vulnerability in the Welcart e-Commerce WordPress plugin versions before 2.12.6. The flaw arises because the plugin does not properly sanitize and escape a parameter before using it in a SQL query, and it removes the escaping previously applied. This vulnerability allows users with the Editor role or higher to perform SQL injection attacks. A fix is available in version 2.12.6.
CVE-2026-104694 is a SQL injection vulnerability in the Thrive Automator WordPress plugin versions before 11.2. The flaw arises because the plugin does not properly sanitize and escape a parameter's array key before using it in a SQL query. This allows authenticated attackers with editor-level access to perform blind SQL injection attacks. The vulnerability is fixed in version 11.2.
CVE-2026-57190 is a high-severity SQL Injection vulnerability in the Asterisk telephony toolkit affecting the PostgreSQL and TDS/MSSQL Channel Event Log backends. It allows arbitrary SQL execution when untrusted data is passed to the CELGenUserEvent dialplan application without proper validation. This issue affects multiple versions prior to the fixed releases and requires the vulnerable backends to be loaded and configured. The vulnerability is fixed in Asterisk versions 20.20.1, 21.12.3, 22.10.1, 23.4.1, and Certified Asterisk 20.7-cert11, 22.8-cert3.
Adobe Campaign Classic contains a critical SQL Injection vulnerability (CVE-2026-105489) that allows a low-privileged attacker to execute arbitrary code without user interaction. The vulnerability involves improper neutralization of special elements in SQL commands, potentially leading to full compromise of the affected system under the context of the current user.
Adobe Campaign Classic (ACC) suffers from a critical SQL Injection vulnerability (CWE-89) that allows an attacker to execute arbitrary SQL commands without user interaction. This can lead to arbitrary code execution in the context of the current user, potentially resulting in full compromise of the victim's account or session. The vulnerability impacts version 0 of the product and has a CVSS score of 10. No patch or remediation information is currently provided.
Adobe Campaign Classic (ACC) contains a critical SQL Injection vulnerability (CVE-2026-104354) that allows an attacker with high privileges to execute arbitrary code without user interaction. This vulnerability involves improper neutralization of special elements in SQL commands, potentially leading to a complete compromise of confidentiality, integrity, and availability. The vulnerability changes the security scope and has a high CVSS score of 9.1.
Adobe Campaign Classic contains an SQL Injection vulnerability that allows a low-privileged attacker to bypass security controls and gain unauthorized read and limited write access without user interaction. The vulnerability affects the product and changes the security scope.
CVE-2026-106076 is a critical SQL injection vulnerability in Veeam Backup for Microsoft 365 versions 8.0 through 8.5.0.1014. It allows an authenticated organization-transfer peer to inject SQL commands into the source server's configuration database. This can lead to unauthorized cross-tenant read and write access to configuration data and remote code execution with the privileges of the PostgreSQL service account.
NVIDIA NeMo Agent Toolkit contains vulnerability where an attacker could cause a SQL injection issue. A successful exploit of this vulnerability might lead to data tampering, denial of service and information disclosure.
Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 - On store product list pages, the value of the sort-by URL parameter is retrieved using a string filter and passed directly to GridboxHelper::getBlogPosts(). When the parameter does not match known sorting keys, it is prefixed with a table alias and inserted into the ORDER BY clause without checking against an allowlist
CVE-2026-10757 is a critical SQL injection vulnerability affecting Esri ArcGIS Server versions 11.1 up to but not including 12.1 on Windows and Linux platforms. This flaw allows a remote attacker with access privileges to the service, potentially including anonymous users if the service is publicly accessible, to execute unauthorized database-specific functions. A patch is available for versions in General Availability and Extended support, including 11.1, 11.3, 11.5, 12.0, and 12.1. Users of unsupported versions are advised to upgrade and apply the patch where possible.
CVE-2026-115418 is a high-severity SQL injection vulnerability in the AWS Cloud Development Kit (CDK) module @aws-cdk/aws-redshift-alpha before version 2.274.0-alpha.0. It allows an attacker who can influence construct property values to execute SQL statements with Amazon Redshift superuser privileges. This includes the ability to grant access to all cluster users. The vulnerability arises from unsafe handling of user names, comments, or passwords in database-query custom resource handlers. AWS has fixed this issue in version 2.274.0-alpha.0 and recommends upgrading and reviewing existing table grants to PUBLIC.