#SQLinjection

CVE-2026-31896: CWE-89: Improper Neutralization of Special Elements used in an S The vulnerability CVE-2026-31896 affects the WeGIA web management system, specifically versions before 3.6.6. The root cause is improper neutralization of special elements in SQL commands (CWE-89), resulting from the use of PHP's extract($_

3 days ago

WeGIA <3.6.6 hit by CRITICAL SQL injection (CVSS 9.8). Remote attackers can access or alter DB data. Upgrade to 3.6.6+ or apply WAF rules now! Full details: radar.offseq.com/threat/cve-2026-31896-cw... #OffSeq #SQLInjection #Cybersecurity

0 0 0 0

Thomas Fricke (he/his)

@thomasfricke.23.social.ap.brid.gy

4 days ago

Original post on 23.social

codewall.ai/blog/how-we-hacked-mckin...

"The agent mapped the attack surface and found the API documentation publicly exposed — over 200 endpoints, fully documented. Most required authentication. Twenty-two didn't.

One of those unprotected endpoints wrote user search […]

0 0 0 0

CVE-2026-30860: CWE-89: Improper Neutralization of Special Elements used in an S Tencent WeKnora, an LLM-powered framework for deep document understanding and semantic retrieval, contains a critical SQL injection vulnerability (CVE-2026-30860) in versions prior to 0.2.12. The vulnerability stems from the application's f

1 week ago

CRITICAL: Tencent WeKnora (<0.2.12) has a severe SQLi flaw (CVE-2026-30860) enabling unauth RCE via PostgreSQL queries. Upgrade to 0.2.12 ASAP! radar.offseq.com/threat/cve-2026-30860-cw... #OffSeq #SQLInjection #Security

0 0 0 0

CVE-2026-28501: CWE-89: Improper Neutralization of Special Elements used in an S CVE-2026-28501 is a critical SQL Injection vulnerability identified in the open-source video platform WWBN AVideo, specifically affecting versions prior to 24.0. The vulnerability exists in the objects/videos.json.php and objects/video.php

1 week ago

CRITICAL: WWBN AVideo < 24.0 hit by SQL Injection via JSON POST (catName). Unauthenticated exploit risks full DB compromise. Upgrade to v24.0+ or add WAF rules now! radar.offseq.com/threat/cve-2026-28501-cw... #OffSeq #Vuln #SQLInjection

0 0 0 0

CVE-2026-27743: CWE-89 Improper Neutralization of Special Elements used in an SQ The SPIP referer_spam plugin, widely used for managing spam referrer data in SPIP CMS environments, contains a severe SQL injection vulnerability identified as CVE-2026-27743. This vulnerability affects all versions prior to 1.3.0 and resid

2 weeks ago

CRITICAL SQL injection (CVE-2026-27743) in SPIP referer_spam <1.3.0 — unauthenticated SQL execution via GET. Update to 1.3.0+ or apply mitigations now. Protect your data! radar.offseq.com/threat/cve-2026-27743-cw... #OffSeq #SQLInjection #SPIP

0 0 0 0

@marryjw.bsky.social

2 weeks ago

How a Single SQL Flaw Can Bypass 2FA and Compromise Your Security

2FA isn’t foolproof. 🚨 Learn how SQL injection, weak hashing, and exposed TOTP secrets can bypass two-factor authentication—without touching the victim’s phone. A real-world breakdown of where security fails.

#CyberSecurity #2FA #SQLInjection

open.spotify.com/episode/6h7i...

0 0 0 0

CVE-2026-26198: CWE-89: Improper Neutralization of Special Elements used in an S Ormar is an asynchronous mini ORM for Python designed to simplify database interactions. Versions 0.9.9 through 0.22.0 contain a critical SQL injection vulnerability (CVE-2026-26198) due to improper neutralization of special elements in SQL

2 weeks ago

🚨 Critical SQL injection in Ormar (0.9.9 – 0.22.0)! No auth needed — attackers can access any DB data. Upgrade to 0.23.0+ or validate inputs urgently. radar.offseq.com/threat/cve-2026-26198-cw... #OffSeq #Python #SQLInjection

0 0 0 0

CVE-2026-24494: CWE-89 Improper Neutralization of Special Elements used in an SQ CVE-2026-24494 identifies a critical SQL Injection vulnerability in the Order Up Online Ordering System version 1.0, specifically in the /api/integrations/getintegrations endpoint. The vulnerability arises from improper neutralization of sp

2 weeks ago

Order Up Online Ordering System v1.0 hit by CRITICAL SQL Injection (CVSS 9.8). Unauthenticated attackers can access or alter backend data. Patch urgently or apply mitigations! radar.offseq.com/threat/cve-2026-24494-cw... #OffSeq #SQLInjection #AppSec

0 0 0 0

CVE-2026-26980: CWE-89: Improper Neutralization of Special Elements used in an S CVE-2026-26980 is a critical SQL Injection vulnerability identified in the TryGhost Ghost content management system, specifically affecting versions from 3.24.0 up to but not including 6.19.1. Ghost is a popular Node.js-based CMS used for b

3 weeks ago

Critical SQL Injection in TryGhost Ghost CMS (3.24.0 – 6.19.0). Unauthenticated attackers can read sensitive DB data. Upgrade to 6.19.1 now! radar.offseq.com/threat/cve-2026-26980-cw... #OffSeq #SQLInjection #GhostCMS

0 0 0 0

CVE-2026-2409: CWE-89 Improper Neutralization of Special Elements used in an SQL CVE-2026-2409 is a critical SQL Injection vulnerability identified in Delinea Cloud Suite, a privileged access management solution widely used in enterprise environments. The flaw stems from improper neutralization of special elements in SQ

3 weeks ago

CRITICAL: SQL Injection in Delinea Cloud Suite (<25.2 HF1) lets low-priv users access or modify data remotely. Patch ASAP, validate inputs, monitor for anomalies. 🛡️ radar.offseq.com/threat/cve-2026-2409-cwe... #OffSeq #SQLInjection #CloudSecurity

0 0 0 0

CVE-2026-2495: CWE-89 Improper Neutralization of Special Elements used in an SQL CVE-2026-2495 is a SQL Injection vulnerability identified in the WPNakama plugin for WordPress, which facilitates team and multi-client collaboration, editorial, and project management functions. The vulnerability specifically targets the '

3 weeks ago

HIGH severity SQL Injection found in WPNakama plugin for WordPress (≤0.6.5). REST API flaw allows data exposure. Patch or deploy WAF now to mitigate risk! radar.offseq.com/threat/cve-2026-2495-cwe... #OffSeq #WordPress #SQLInjection

1 0 0 0

1 month ago

CISA alerts on critical SQL injection vulnerability in Microsoft Configuration Manager (CVE-2024-43468). Immediate patching required to prevent active exploits. #CyberSecurity #SQLInjection #Microsoft Link: thedailytechfeed.com/critical-sql...

0 0 0 0

1 month ago

Fortinet addresses critical SQL Injection vulnerability (CVE-2026-21643) in FortiClientEMS. Users urged to update to version 7.4.5 or later. #CyberSecurity #Fortinet #SQLInjection #PatchNow Link: thedailytechfeed.com/fortinet-urg...

0 0 0 0

CVE-2026-25993: CWE-89: Improper Neutralization of Special Elements used in an S CVE-2026-25993 is a critical SQL Injection vulnerability identified in the EverShop eCommerce platform, specifically affecting versions prior to 2.1.1. EverShop is a TypeScript-first platform widely used for online retail solutions. The vul

1 month ago

CRITICAL: EverShop (<2.1.1) is vulnerable to unauthenticated SQL injection (CVE-2026-25993). Patch to v2.1.1+ or apply input controls now! radar.offseq.com/threat/cve-2026-25993-cw... #OffSeq #SQLInjection #eCommerce

0 0 0 0

1 month ago

Critical #FortiClientEMS vulnerability (CVE-2026-21643) allows remote code execution. Immediate patching to version 7.4.5+ is essential. #CyberSecurity #InfoSec #SQLInjection Link: thedailytechfeed.com/critical-for...

0 0 0 0

TechNadu

@technadu.com

1 month ago

🚨 Fortinet patches critical SQLi flaw enabling unauthenticated code execution.

Management platforms remain high-value targets.

Follow TechNadu for clear, security-first reporting.

#CyberSecurity #Fortinet #SQLInjection #PatchNow #Infosec #TechNadu

1 0 0 0

1 month ago

Fortinet addresses critical SQL Injection vulnerability (CVE-2026-21643) in FortiClientEMS. Users urged to update to version 7.4.5 or later. #CyberSecurity #Fortinet #SQLInjection #PatchNow Link: thedailytechfeed.com/fortinet-iss...

0 0 0 0

CVE-2026-25544: CWE-89: Improper Neutralization of Special Elements used in an S CVE-2026-25544 is a critical SQL injection vulnerability identified in Payload CMS, a free and open-source headless content management system widely used for managing structured content. The flaw exists in versions prior to 3.73.0 and is ca

1 month ago

Payload CMS <3.73.0 hit by CRITICAL SQL injection (CVE-2026-25544). Unauthenticated attackers can steal sensitive data & take over accounts. Upgrade to 3.73.0+ now! radar.offseq.com/threat/cve-2026-25544-cw... #OffSeq #PayloadCMS #SQLInjection

0 0 0 0

@marryjw.bsky.social

1 month ago

Learn how SQL Injection attacks exploit vulnerabilities to access, manipulate, or steal sensitive databases. Discover real-world impacts and key practices to protect your data.

podcasts.apple.com/us/podcast/s...

#SQLInjection #CyberSecurity #DatabaseSecurity #InfoSec

1 0 0 0

1 month ago

Critical SQL injection vulnerability (CVE-2025-26385) found in Johnson Controls products. Immediate action required to protect critical infrastructure. #CyberSecurity #SQLInjection #JohnsonControls Link: thedailytechfeed.com/critical-sql...

0 0 0 0