#sqlinjection

Active exploitation attempts are targeting CVE-2026-9586, a critical unauthenticated SQL injection in Sangoma Switchvox SMB Edition. A single crafted request enables arbitrary SQL execution on PostgreSQL and leads to remote code execution via reverse shell. Immediate patching and exposure review are critical. #Switchvox #SqlInjection #ThreatIntel https://cyberworldops.eu/en/switchvox-under-attack-critical-sql-injection-installs-reverse-shell

Adobe patched critical Adobe Campaign Classic flaws. CVE-2026-48331 scores CVSS 10.0 and enables arbitrary code execution. Update to build 9399 now. #Adobe #AdobeCampaignClassic #CVE202648331 #ArbitraryCodeExecution #Vulnerability #SSRF #SQLInjection #InfoSec #CyberSecurity https://securityonline.info/adobe-campaign-classic-cve-2026-48331/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-16462 is a critical SQL injection in Weidmueller PROCON-WEB SCADA, rated CVSS 9.8. An unauthenticated attacker can run SQL commands. Patch now. #PROCONWEB #Weidmueller #CVE202616462 #SQLInjection #SCADA #CyberSecurity https://securityonline.info/procon-web-scada-cve-2026-16462/?utm_source=mastodon&utm_medium=jetpack_social

A PHP SQL injection flaw, CVE-2026-17543, was patched alongside two memory bugs. Update to PHP 8.2.33, 8.3.33, 8.4.24, or 8.5.9 now. #PHP #SQLInjection #CVE202617543 #PostgreSQL #Vulnerability #InfoSec https://securityonline.info/php-sql-injection-cve-2026-17543/?utm_source=mastodon&utm_medium=jetpack_social

CISA added four flaws to its KEV catalog, including WordPress RCE (CVE-2026-63030) and Langflow RCE (CVE-2026-0770). All are exploited in the wild. #CISA #KEV #WordPress #Langflow #DDWRT #RCE #SQLInjection https://securityonline.info/cisa-kev-four-exploited-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

Three Apache Fineract SQL injection flaws (CVE-2026-57821, CVE-2026-56287, CVE-2026-35152) let authenticated users exfiltrate data. Upgrade to 1.15.0. #ApacheFineract #SQLInjection #CVE #CoreBanking #InfoSec http://securityonline.info/apache-fineract-sql-injection/?utm_source=mastodon&utm_medium=jetpack_social

The wp2shell chain turns two WordPress core bugs into unauthenticated RCE on default installs. Update to 6.9.5, 7.0.2, or 6.8.6 immediately. #WordPress #wp2shell #RCE #SQLInjection #RESTAPI #CVE https://securityexpress.info/wp2shell-wordpress-rce/?utm_source=mastodon&utm_medium=jetpack_social

🚨 CRITICAL: WordPress Core "wp2shell" RCE A single anonymous HTTP request can lead to Remote Code Execution on vulnerable WordPress Core installations. ⚠️ No plugins. ⚠️ No themes. ⚠️ No authentication required. Tracked as: 🔴 CVE-2026-63030 (REST API Batch Route Confusion → RCE) 🔴 CVE-2026-60137 (Facilitated SQL Injection) Affected versions • WordPress 6.9.0–6.9.4 • WordPress 7.0.0–7.0.1 ✅ Update immediately to WordPress 6.9.5 or 7.0.2. Due to the severity, WordPress has enabled forced automatic security updates for affected installations. 🔗 Full technical analysis: https://thecybersecguru.com/news/wordpress-core-rce-wp2shell/ #WordPress #WordPressSecurity #wp2shell #CVE202663030 #CVE202660137 #RCE #RemoteCodeExecution #SQLInjection #RESTAPI #CyberSecurity #InfoSec #WebSecurity #WebsiteSecurity #PatchNow #ThreatIntelligence #BlueTeam #SOC #Linux #PHP #ZeroDay #SecurityResearch #SysAdmin #DevSecOps

If you're looking at the #Wordpress PoC for https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q at https://github.com/attackercan/wp2shell-poc2 , please be aware that the "check" and "read" PoC do not always work. I assume it was created on an empty Wordpress install (with 0 posts). But if it's populated, the OR SLEEP(3) is short circuited away. Trust your version.php instead. (wp2shell-poc does not have an issue tracker enabled to report this to.) #sqlinjection #vulnerability #cve #infosec

WordPress pre-auth RCE CVE-2026-63030 chains a REST batch bug with SQL injection. Details and a public PoC are out. Update to WordPress 7.0.2 now. #WordPress #PreAuthRCE #CVE202663030 #SQLInjection #wp2shell #WebSecurity #InfoSec https://securityonline.info/wordpress-pre-auth-rce-cve-2026-63030/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-1207 is a Django SQL injection flaw (CVSS 8.3) in PostGIS raster lookups. Canada's CCCS says it is exploited in the wild. Patch now. #Django #SQLInjection #CVE20261207 #PostGIS #InfoSec https://securityonline.info/django-sql-injection-cve-2026-1207/?utm_source=mastodon&utm_medium=jetpack_social

A public PoC is available for CVE-2026-57517, a critical CVSS 9.8 Control Web Panel SQLi flaw allowing unauthenticated remote code execution. #CVE202657517 #ControlWebPanel #SQLInjection #CyberSecurity #Vulnerability https://securityonline.info/cve-2026-57517-control-web-panel-sqli/?utm_source=mastodon&utm_medium=jetpack_social

https://codewall.ai/blog/how-we-hacked-mckinseys-ai-platform "The agent mapped the attack surface and found the API documentation publicly exposed — over 200 endpoints, fully documented. Most required authentication. Twenty-two didn't. One of those unprotected endpoints wrote user search queries to the database. The values were safely parameterised, but the JSON keys — the field names — were concatenated directly into SQL." Read and write access to everything. #mckinsey #security #ai #sqlinjection