CVE WatchSep 29, 2026

CVE-2026-102570

ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the language update function where the language_

CVSS

5.5

Medium

EPSS

0.2%

p14

KEV

—

Exploit Today

0-100

Published: Sep 29, 2026 · Last modified: Sep 29, 2026 · CWE-89

EPSS · 30d

0.2%EPSS · 30 days0.2%

2026-09-302026-10-19

Technical description

ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the language update function where the language_id parameter is concatenated unescaped into the WHERE clause of an UPDATE statement. An authenticated administrator with basic_settings permission can inject arbitrary SQL payloads to extract or modify database contents.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-1140847.7 HIG

—

———Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint, which concatenates the unescaped tags query parameter into the ElectricSQL shape where clause and defeats the runtimeEnvironmentId tenant guard. Authenticated attackers holding any project API key with read:runs scope can append boolean conditions to stream TaskRun records, including payloads and metadata, from every organization on the same self-hosted instance.4h CVE-2026-1140817.7 HIG

—

———Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without allowlisting or escaping. Authenticated customers can submit a backtick-quoted identifier to POST /api/v1/query that injects a raw subquery outside the per-tenant WHERE guard, exfiltrating other organizations' analytics data.4h CVE-2026-1140656.5 MED

—

———Trigger.dev before 4.7.3 contains a tenant filtering bypass vulnerability that allows authenticated users to read other tenants' data by using placeholder table syntax in POST /api/v1/query. Attackers can submit queries with FROM {database.table} expressions, including within subqueries, to skip table allowlist and tenant filters and expose run metadata and payloads.4h CVE-2026-1137406.3 MED

—

———A flaw has been found in itsourcecode Online Cake Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /deletecustomer.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.4h CVE-2015-201288.2 HIG

—

———FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate MSSQL queries through the CityId parameter. Attackers can send GET requests to /user/City_ajax.aspx with UNION SELECT payloads in CityId, concatenated unsanitized into the sys_City query, to extract database information. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.8h CVE-2026-1136085.3 MED

—

———Configurable Reports block for Moodle (moodle-block_configurablereports) before 5.3.1 contains an sql injection vulnerability in report_sql::prepare_sql() via the filter_var request parameter of viewreport.php. Low-privileged users permitted to view reports using the %%FILTER_VAR%% placeholder can inject subqueries or UNION SELECT to read arbitrary database tables, including user password hashes.9h