CVE-2026-118120

HighCVSS 8.8/10Last modified Nov 10, 2026

Description

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 10, 2026
Last modified: Nov 10, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1181237.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Point-to-Point Protocol over Ethernet CVE-2026-1181247.0Out-of-bounds read in Windows Internet Connection Sharing (ICS) allows an authorized attacker to elevate privileges locally.CVE-2026-1181257.0Use after free in Windows Message Queuing allows an authorized attacker to elevate privileges locally.CVE-2026-1181267.8Use after free in Windows Message Queuing allows an authorized attacker to elevate privileges locally.CVE-2026-1181286.5A vulnerability has been found in a2aproject a2a-js up to 1.1.0. Impacted is the function ResultManager.applyStatusUpdate of the file src/se CVE-2026-1181296.3A vulnerability was found in jeremyckahn Chitchatter up to f82538633813c854a81a8b2112a2f6ba17b39cbc. The affected element is the function is CVE-2026-118137.8A potential improper permissions vulnerability was reported in the Lenovo Filez Client application that could allow a local authenticated us CVE-2026-1181319.8GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\Pro CVE-2026-1181326.1NextChat version 2.16.1 contains a client‑side cross‑site scripting (XSS) vulnerability in the Plugin Editor due to unsafe rendering of exte CVE-2026-1181377.8Improper authorization in Windows FTP Service allows an authorized attacker to elevate privileges locally.CVE-2026-1181387.8Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Client for NFS allows an authorized a CVE-2026-118146.8A command injection vulnerability in the listed NETGEAR models allows a network-adjacent attacker with the ability to intercept and modify l