SQL injection
Also called: SQLi
A flaw where an application builds database queries from user input without separating code from data, letting an attacker insert SQL commands to read, alter or delete data and sometimes run commands on the server. The fix is in the code: use parameterized queries everywhere and give the application's database account only the permissions it needs. A WAF can reduce exposure but is not a substitute.
Further reading: owasp.org
Advisories that mention this term
NVIDIA NeMo Agent Toolkit Patched for Vulnerabilities Reaching CVSS 10.0
According to Security NEXT, NVIDIA disclosed two vulnerabilities in the NeMo Agent Toolkit on October 27, 2026, and released fixed versions .
End-of-Life SonicWall GMS Discloses Two Unpatched Vulnerabilities; Vendor Urges Migration
According to Security NEXT, SonicWall disclosed two vulnerabilities in Global Management System (GMS) on November 3, 2026, but will not provide patches because the product has reached end of support .
TWCERT: Multiple High-Risk Vulnerabilities in HPE Networking AOS-10 and AOS-8 Require Prompt Patching
On 2026-11-06, TWCERT/CC reported multiple high-risk vulnerabilities in HPE Networking AOS-10 and AOS-8, including authentication bypass, buffer overflow, SQL injection, command injection, and sensitive information disclosure .
BA-Workflow Form Platform Contains Three SQL Injection Vulnerabilities (CVE-2026-113405 to CVE-2026-113407)
On October 20, TWCERT/CC published TVN-202610007: Asia Xuan Information's BA-Workflow contains three SQL injection vulnerabilities, each with a CVSS v4.
CISA Adds Cisco Secure Email Gateway Vulnerability CVE-2026-76461 to Known Exploited Vulnerabilities Catalog
On 2026-09-14, CISA added CVE-2026-76461 (Cisco Secure Email Gateway) to its Known Exploited Vulnerabilities (KEV) catalog .