PULSEUnderground Intel

EN VIVO59señales / 24h

FEED

ransomn0n reclama a Delta Dental of Missouri · US · Healthcareransomn0n reclama a The Container Store · US · Retail & E-Commerceransomlockbit5 reclama a centratamagroup.com · BR · Otherransommedusalocker reclama a Msn · US · Technologyransommedusalocker reclama a baiapai · Technologyransommedusalocker reclama a Vinitgloves · IN · Manufacturingransommedusalocker reclama a Jatlransommedusalocker reclama a Geeteesransommedusalocker reclama a Ruixiang Jidian · Manufacturingransommedusalocker reclama a Kde · Technologyransommedusalocker reclama a Jobmongers · GB · Professional Servicesransommedusalocker reclama a baeaqabransommedusalocker reclama a Ulaval · CA · Educationransommedusalocker reclama a On · CH · Retail & E-Commerceransomn0n reclama a Delta Dental of Missouri · US · Healthcareransomn0n reclama a The Container Store · US · Retail & E-Commerceransomlockbit5 reclama a centratamagroup.com · BR · Otherransommedusalocker reclama a Msn · US · Technologyransommedusalocker reclama a baiapai · Technologyransommedusalocker reclama a Vinitgloves · IN · Manufacturingransommedusalocker reclama a Jatlransommedusalocker reclama a Geeteesransommedusalocker reclama a Ruixiang Jidian · Manufacturingransommedusalocker reclama a Kde · Technologyransommedusalocker reclama a Jobmongers · GB · Professional Servicesransommedusalocker reclama a baeaqabransommedusalocker reclama a Ulaval · CA · Educationransommedusalocker reclama a On · CH · Retail & E-Commerce

← Todos los CVEs

CVE Watch1 sept 2026

CVE-2026-74820

ServiceNow has remediated a SQL injection vulnerability that was identified in in the ServiceNow AI platform. This vulnerability could enabl

CVSS

—

Sin CVSS

EPSS

5.1%

p92

KEV

—

Exploit Today

28

0-100

Publicado: 27 ago 2026 · Última mod.: 1 sept 2026 · CWE-89

EPSS · 30d

0.4%EPSS · 30 días5.1%

2026-10-072026-11-03

Descripción técnica

ServiceNow has remediated a SQL injection vulnerability that was identified in in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gain access to, or modify, instance data beyond what was intended. ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.

Referencias oficiales

support.servicenow.comhttps://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3152242

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-1221916.3 MED

———A vulnerability was determined in itsourcecode Airline Reservation System 1.0. This affects an unknown function of the file /admin/manage_booked.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.6h CVE-2026-1220507.3 ALT

———A vulnerability was found in Campcodes Complete Sales and Inventory System with Credit Management 1.0. This issue affects some unknown processing of the file /ahira/login.php. Performing a manipulation of the argument branch results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.10h CVE-2026-47678—

———GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, any authenticated user can submit crafted values to the dropdown values fetching endpoint that are incorporated into a database query. This permits SQL injection through the dropdown endpoint. This issue is fixed in versions 11.0.8 and 10.0.26.11h CVE-2026-1220487.3 ALT

———A vulnerability was identified in Campcodes Division Regional Athletic Meet Game Result Matrix System up to 2.1. This affects an unknown function of the file /dipam/check-user.php. Such manipulation of the argument abbr leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.11h CVE-2026-1220387.3 ALT

———A vulnerability was identified in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this issue is the function mysql_query of the file source/reqformprocessing.php of the component Requirement Board Update Handler. Such manipulation leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.11h CVE-2025-714568.1 ALT

———vtenext before 25.02.2 contains an SQL injection vulnerability that allows authenticated low-privileged users to inject SQL by supplying a crafted fieldname parameter to modules/Fax/EditView.php. Attackers can read arbitrary database contents, including password reset tokens stored in vte_userauthtoken, to take over other user accounts.13h