CVE-2026-42708
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AF themes WP Post Author wp-post-autho
CVSS
7.6
Alta
EPSS
0.2%
p13
KEV
—
Exploit Today
4
0-100
Publicado: 7 de out. de 2026 · Última mod.: 7 de out. de 2026 · CWE-89
0.2%EPSS · 30 dias0.2%
2026-10-082026-11-05
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AF themes WP Post Author wp-post-author allows Blind SQL Injection.This issue affects WP Post Author: from n/a through 4.0.0.
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-637749.0 CRÍ—
———Insufficient input validation in the PowerSYSTEM Center report designer allows an authenticated user to execute unauthorized SQL commands.2hCVE-2025-714587.5 ALT—
———FTS3 Web Monitoring (fts-monitoring) versions 3.12.0 through 3.13.2 and 3.14.0 contain an unauthenticated sql injection vulnerability in the /linkinfo endpoint handled by get_linkinfo. Remote attackers can inject SQL through the source_se and dest_se query parameters to perform blind injection and read stored cloud storage credentials and token provider client secrets.2hCVE-2026-889856.5 MÉD—
———Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the API server trusts structural SQL identifier fields decoded from the base64-encoded JSON page_token parameter before constructing list queries. An attacker who can invoke an affected pipeline or run list API can inject through KeyFieldName or SortByFieldName, including v1beta1 and v2beta1 run-listing metric paths, and read data available to the API server database account across namespaces. Database modification is not established. This issue is fixed in version 2.17.0.5hCVE-2026-339448.8 ALT—
———Dolibarr is an open-source enterprise resource planning and customer relationship management application. Prior to 22.0.5 and 23.0.1, there is a SQL injection vulnerability in the Third Party company update functionality. The application concatenates the localtax1_value and localtax2_value properties into an SQL UPDATE statement without numeric conversion or other appropriate sanitization. An authenticated user with Third Party create or edit permission can submit crafted lt1 or lt2 POST parameters to read sensitive database information, including password hashes, API keys, and business data, or modify third-party records. This issue is fixed in versions 22.0.5 and 23.0.2.5hCVE-2026-111492——
———SQL injection in the push notification handler of the MatchPoint Android app, which processes messages from Firebase Cloud Messaging and constructs queries by concatenating untrusted data. An attacker capable of interacting with the component could manipulate queries and access sensitive information from the local database, including credentials stored in the versions described in the report. The scope of the injection is limited to the device.5hCVE-2026-973778.8 ALT—
——0SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the legacy SOAP portal method portal_get_entry_list propagates caller-controlled where and order_by values into SQL query construction without sufficient neutralization. A low-privileged portal API user can perform blind SQL injection to disclose database metadata and sensitive records, affect query behavior, and consume resources. This issue is fixed in versions 7.15.2 and 8.10.2.6h