CVE WatchSep 14, 2026

CVE-2026-82232

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope. An administrator wi

CVSS

—

No CVSS

EPSS

—

KEV

—

Exploit Today

0-100

Published: Sep 14, 2026 · Last modified: Sep 14, 2026 · CWE-89

EPSS · 30d

Not enough EPSS history yet.

Technical description

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort clauses for Task search. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

Official references

lists.apache.orghttps://lists.apache.org/thread/v5zrdqcn0w0v4pk1d22ndt7frcrplo2b

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-907087.3 HIG

—

——0A weakness has been identified in Yot CMS up to 3.3.1. Affected by this vulnerability is the function Login of the file global.php of the component Cookie Handler. This manipulation of the argument yot3_user/yot3_pass causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.4h CVE-2026-891807.5 HIG

—

——0EFence developed by Thinking Software Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents.3h CVE-2026-86460—

—

——0Cypher injection vulnerability in the Neo4j persistence layer when processing some FIQL search conditions. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.4h CVE-2026-78375—

—

——0Joomla Extension - joomshaper.com - Authenticated Privileged SQL Injection in the Content Plugin of SP Page Builder (Free and Pro) 5.2.1 - 6.9.0 - plgContentSppagebuilder::onContentAfterSave() read jform[attribs][sppagebuilder_article_id] from the request and concatenated it directly into the WHERE view_id = ... clause of a query against #__sppagebuilder without quoting or type casting. Joomla's ARRAY input filter does not sanitise element values, as InputFilter::clean() returns (array) $source with the elements untouched, so the entire payload could be delivered in a single POST field. The affected block also executed before the com_content.article context test, so it ran on every onContentAfterSave event regardless of which component triggered the save. An attacker could perform time-based blind SQL injection to read arbitrary database contents, including the #__users and #__session tables.4h CVE-2026-907017.3 HIG

—

——0A vulnerability was detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. The affected element is an unknown function of the file listdoctor.php. Performing a manipulation of the argument searchtext results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.5h CVE-2026-907006.3 MED

—

——0A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/pro_edit1.php. Such manipulation of the argument prodcode leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.6h