CVE-2026-118118
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate
CVSS
8.0
Alta
EPSS
—
KEV
—
Exploit Today
0
0-100
Publicado: 10 de nov. de 2026 · Última mod.: 10 de nov. de 2026 · CWE-89
Ainda não há histórico EPSS suficiente.
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1040606.5 MÉD—
——0Worklenz before 3.3.0 contains an SQL injection vulnerability in the reporting members endpoints that allows authenticated attackers to read arbitrary database contents by injecting SQL through the projects and status parameters. Attackers can send crafted values to POST /api/v1/reporting/members/all or GET /api/v1/reporting/members/export, which are interpolated unparameterized into IN clauses in getTeamMemberInsightData, and use time-based blind techniques to extract data across tenants, including user password hashes.3hCVE-2026-1181208.8 ALT—
——0Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.3hCVE-2026-1181198.0 ALT—
——0Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.3hCVE-2026-1181178.0 ALT—
——0Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.3hCVE-2026-1181167.0 ALT—
——0Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.3hCVE-2026-1181157.5 ALT—
——0Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.3h