https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-15T11:37:18.633903+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-58492 CVE-2026-58492 — grav-plugin-database: SQL Injection in PDO::tableExists() due to Unsanitized Table Name Interpolation 2026-10-15T11:37:18.650278+00:00

Affected: getgrav grav

grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, the PDO::tableExists method interpolates its table argument directly into a raw SQL query string without sanitization, escaping, quoting, or whitelisting, allowing attacker-controlled table names passed by consuming plugin or developer code to execute arbitrary SQL against the configured database. This issue is fixed in version 1.2.0.