CVE-2026-8111
SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote
CVSS
8.8
Alto
EPSS
6.3%
p94
KEV
—
Exploit Today
28
0-100
Publicado: 12 may 2026 · Última mod.: 26 oct 2026 · CWE-89
1.6%EPSS · 30 días6.3%
2026-10-052026-11-01
SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote code execution.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1200657.1 ALT—
———For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to identify rows. It places the column's name, as reported by the server, between double quotes in its keyset queries and in the WHERE clause of its positioned SELECT, UPDATE, and DELETE statements, without doubling any double quote in the name. A column name that contains a double quote therefore changes the SQL that the driver runs with the application's privileges, including which rows a positioned UPDATE or DELETE affects. Any database user who can create a table that the application reads with an updatable cursor can choose such a name, and so can a server not trusted under current SSL settings. Versions before psqlODBC 18.00.0006 are affected.5hCVE-2026-1200627.5 ALT—
———SQLSpecialColumns in psqlODBC splices the table and schema names it receives into its catalog query without escaping them, while the other catalog functions escape them. An application that passes an untrusted table or schema name to SQLSpecialColumns lets the caller execute arbitrary SQL with the privileges of the connection. Versions before psqlODBC 18.00.0006 are affected.5hCVE-2026-105604——
———Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds < 3.11.3 - The Joomla extension DJ-Classifieds is vulnerable to an unauthenticated SQL injection vector in the frontend search.6hCVE-2026-1193017.9 ALT—
———Improper neutralization of quoting syntax in SQL identifier construction in the Apache Iceberg write component in AWS SDK for pandas (also published as awswrangler) 3.5.2 through 3.17.0 might allow an authenticated remote user with permission to modify AWS Glue Data Catalog metadata to read any table that a separate, more privileged principal can access and write to the table that principal is updating via a crafted column name.
To remediate this issue, users should upgrade to version 3.17.1 or later.6hCVE-2026-778816.2 MED—
———Control Web Panel (CWP) before webpanel_version 1.30 contains a blind SQL injection vulnerability in an unauthenticated loopback API route that connects to MySQL as root, where the 'user' parameter is interpolated directly into a query against the oauth_clients table. Attackers can send crafted requests to the unauthenticated route (originally /user_panel_dashboard/, later /valid_token/) to perform time-based blind SQL injection and extract arbitrary database contents.6hCVE-2026-778797.7 ALT—
———Control Web Panel (CWP) before webpanel_version 1.16 contains a SQL injection vulnerability in the loopback API authentication gate access_token(), which connects to MySQL as root and interpolates attacker-controlled values directly into its query. Attackers can inject SQL through the authorization_code and client_id parameters to read arbitrary database contents and forge the authentication result, bypassing the API's authentication check.6h