Base de CVEs

CVE-2026-52851 Alta · 7.1 CWE-89 17/09/2026

Traccar: Authenticated Blind SQL Injection in DELETE /api/permissions

Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated, non-readonly user with access to an object usable in a permission pair can submit DELETE /api/permissions with an extra attacker-controlled JSON key. Permission(LinkedHashMap<String, Long>) in src/main/java/org/traccar/model/Permission.java validates only the first two keys, but DatabaseStorage.removePermission() in src/main/java/org/traccar/storage/DatabaseStorage.java concatenates every map key into the SQL WHERE clause as a column identifier. The extra key therefore becomes attacker-controlled SQL and provides a blind boolean or error oracle that can extract arbitrary database values, including administrator email, password hashes, and salts, or conditionally delete permission rows. Unauthenticated requests are rejected. This issue is fixed in 6.14.0.

CVE-2026-93292 Alta · 8.5 CWE-89 17/09/2026

SigNoz 0.88.0 before 0.142.1 - SQL Injection in Trace Funnel Analytics Query Builders

SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints that interpolate service_name and span_name fields into ClickHouse string literals without escaping. Authenticated attackers can inject SQL through funnel step definitions to execute arbitrary queries and read results in HTTP responses.

CVE-2026-79752 Crítica · 9.2 CWE-89 17/09/2026

CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection

CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit values and incorporate them into generated SQL as unescaped structural fragments. An application that passes untrusted input to these parameters can permit SQL injection with confidentiality, integrity, and availability impact according to the database connection's privileges. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7.

CVE-2026-66631 Alta · 7.6 CWE-89 17/09/2026

WordPress MC Woocommerce Wishlist plugin <= 1.9.21 - SQL Injection vulnerability

Administrator SQL Injection in MC Woocommerce Wishlist <= 1.9.21 versions.

CVE-2026-66630 Alta · 7.6 CWE-89 17/09/2026

WordPress PublishPress Series plugin <= 3.1.3 - SQL Injection vulnerability

Administrator SQL Injection in PublishPress Series <= 3.1.3 versions.

CVE-2026-66628 Alta · 7.6 CWE-89 17/09/2026

WordPress WP-Lister Lite for eBay plugin <= 3.8.11 - SQL Injection vulnerability

Shop manager SQL Injection in WP-Lister Lite for eBay <= 3.8.11 versions.

CVE-2026-66626 Alta · 7.6 CWE-89 17/09/2026

WordPress SKT Addons for Elementor plugin <= 4.0 - SQL Injection vulnerability

Editor SQL Injection in SKT Addons for Elementor <= 4.0 versions.

CVE-2026-66625 Alta · 7.6 CWE-89 17/09/2026

WordPress WC Vendors Marketplace plugin <= 2.7.2.1 - SQL Injection vulnerability

Administrator SQL Injection in WC Vendors Marketplace <= 2.7.2.1 versions.

CVE-2026-66624 Alta · 7.6 CWE-89 17/09/2026

WordPress WPMasterToolKit plugin <= 2.22.0 - SQL Injection vulnerability

Administrator SQL Injection in WPMasterToolKit <= 2.22.0 versions.

CVE-2026-66619 Alta · 7.6 CWE-89 17/09/2026

WordPress Newsletters plugin <= 4.18 - SQL Injection vulnerability

Administrator SQL Injection in Newsletters <= 4.18 versions.

CVE-2026-66618 Alta · 7.6 CWE-89 17/09/2026

WordPress WP Maps plugin <= 4.9.9 - SQL Injection vulnerability

Administrator SQL Injection in WP Maps <= 4.9.9 versions.

CVE-2026-66580 Alta · 8.5 CWE-89 17/09/2026

WordPress Product Feed Manager plugin <= 7.12.0 - SQL Injection vulnerability

Contributor SQL Injection in Product Feed Manager <= 7.12.0 versions.

CVE-2026-92903 Alta · 8.2 CWE-89 17/09/2026

Improper Input Validation in Snowflake CLI Versions Allow Unsanitized User-Controlled Values to be Interpolated into SQL Strings

Improper input validation in Snowflake CLI versions prior to 3.27.0 allowed unsanitized user-controlled values to be interpolated into SQL strings that are executed as multi-statement queries. An attacker who is able to supply a malicious project configuration file or craft command-line input can cause Snowflake CLI to execute attacker-controlled SQL statements in the context of the victim's Snowflake session and active role. Successful exploitation requires either write or pull-request access to a project repository whose CI/CD pipeline runs Snowflake CLI under an elevated service account role, or the ability to supply untrusted input to CLI-wrapping automation. Impact is limited by the privileges held by the configured Snowflake role at execution time. The fix is available in Snowflake CLI version 3.27.0, which also addresses several additional security findings. Users must manually upgrade.

CVE-2026-87963 Alta · 8.6 CWE-89 17/09/2026

Yo 1.1 - 1.3.1 - Unauthenticated SQL Injection via username Parameter

The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthenticated attackers to perform SQL injection and read arbitrary database contents including administrator password hashes.

CVE-2026-76449 Média · 4.9 CWE-89 16/09/2026

Cisco Identity Services Engine SQL Injection Vulnerability

A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the affected APIs before it is used to build database queries. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to execute arbitrary SQL or HQL queries against the underlying database, which could allow the attacker to view or modify data that they are not authorized to access. To exploit this vulnerability, the attacker must have valid administrative credentials.

CVE-2026-76448 Média · 4.9 CWE-89 16/09/2026

Cisco Identity Services Engine SQL Injection Vulnerability

A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the affected APIs before it is used to build database queries. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to execute arbitrary SQL or HQL queries against the underlying database, which could allow the attacker to view or modify data that they are not authorized to access. To exploit this vulnerability, the attacker must have valid administrative credentials.

CVE-2026-76428 Média · 4.9 CWE-89 16/09/2026

Cisco ISE Profiler SQL Injection Vulnerability

A vulnerability in the REST APIs of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct SQL injection attacks against the session database. This vulnerability is due to certain parameters being concatenated directly into SQL clauses without parameterization. An attacker could exploit this vulnerability by sending a crafted request that contains SQL statements in one of the affected parameters. A successful exploit could allow the attacker to read information from the session database. To exploit this vulnerability, the attacker must have valid administrative credentials.

CVE-2026-76426 Média · 4.9 CWE-89 16/09/2026

Cisco ISE REST API SQL Injection Vulnerability

A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct SQL injection attacks against the monitoring database. This vulnerability is due to insufficient validation of specific parameters that are then concatenated into an SQL statement. An attacker could exploit this vulnerability by sending a crafted request that contains SQL statements in one of the affected parameters. A successful exploit could allow the attacker to read information from the monitoring database. To exploit this vulnerability, the attacker must have valid administrative credentials.

CVE-2026-76425 Alta · 7.6 CWE-89 16/09/2026

Cisco ISE SQL Injection Vulnerability

A vulnerability in the APIs of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks against the backend database. This vulnerability is due to insufficient validation of certain parameters that are concatenated directly into an SQL query. An attacker could exploit this vulnerability by sending a crafted request that contains SQL statements to an affected endpoint. A successful exploit could allow the attacker to read arbitrary content from the SQL database and conduct server-side request forgery (SSRF) attacks. To exploit this vulnerability, the attacker must have valid administrative credentials.

CVE-2026-75513 Crítica · 9.1 CWE-89 16/09/2026

Marten: SQL injection in Marten's LINQ provider via unescaped string literals

Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. From version 7.0.0 until 9.13.0, several Marten LINQ and tenant-management paths interpolate runtime, potentially attacker-controlled strings into single-quoted SQL literals without escaping or parameterization. The primary confirmed vector is a dictionary indexer key used by Where filters in src/Marten/Linq/Members/Dictionaries/DictionaryItemMember.cs. Additional affected sinks include SelectParser.cs, DatabaseScopedTenantPartitions.cs, and DeleteAllForTenant.cs reached through IEventStore.DeleteProjectionProgressAsync, while DictionaryContainsKeyFilter.cs (Newtonsoft serializer only; System.Text.Json is not affected) handles ContainsKey calls. Events/Daemon/Internals/EventLoader.cs contains a related per-tenant partition-pruning literal that the advisory identifies as a defense-in-depth sink. A crafted single quote can escape the generated literal, enabling filter or multi-tenant authorization bypass and blind data exfiltration, and deployments that permit semicolon-batched Npgsql statements may also allow data modification. This issue is fixed in version 9.13.0.

CVE-2026-20344 Alta · 8.8 CWE-89 16/09/2026

Cisco Secure Firewall Management Center Software SQL Injection Vulnerability

A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, remote attacker to perform a SQL injection attack against an affected device. To exploit this vulnerability, the attacker must have a valid account on the device with the role of Security Approver, Access Admin, or Network Admin. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web-based management interface of an affected device. A successful exploit could allow the attacker to obtain any data from the database, obtain the session credentials of an authenticated Administrator, and take actions with administrative privileges on the affected device.

CVE-2026-20300 Alta · 7.1 CWE-89 16/09/2026

Cisco Identity Services Engine SQL Injection Vulnerability

A vulnerability in Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected device. To exploit this vulnerability, the attacker must have at least low-privileged administrative credentials. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to read or modify data in the underlying database.

CVE-2026-20247 Alta · 7.5 CWE-89 16/09/2026

Cisco Identity Services Engine Unauthenticated SQL Injection Vulnerability

A vulnerability in Cisco ISE could allow an unauthenticated, remote attacker to conduct SQL injection attacks on an affected device. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to modify data in the underlying database.

CVE-2026-20235 Média · 4.9 CWE-89 16/09/2026

Cisco Identity Services Engine Information Disclosure Vulnerability

A vulnerability in the API of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to view sensitive information on an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to insufficient validation of user-supplied parameters in API requests. An attacker could exploit this vulnerability by sending a crafted API request to an affected device. A successful exploit could allow the attacker to gain access to sensitive information, including hashed credentials that could be used in future attacks.

CVE-2026-87105 Alta · 8.8 CWE-89 16/09/2026

Tanium addressed a SQL injection vulnerability in Threat Response.