CVE-2026-66659

CriticalCVSS 9.3/10Last modified Oct 24, 2026

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Essekia Tablesome Table allows Blind SQL Injection.

This issue affects Tablesome Table: from n/a through 1.2.9.

Metrics

CVSS 3.1 9.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Aug 12, 2026
Last modified
Oct 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-66667.5A possible null pointer reference in PgBouncer before 1.25.2 could lead to a crash, if a server sends an error response without SQLSTATE fieCVE-2026-666606.5Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on <= 2.5.1 versions.CVE-2026-666617.7Subscriber Privilege Escalation in Directories Pro <= 2.0.5 versions.CVE-2026-666629.8Unauthenticated Privilege Escalation in Frontend Admin by DynamiApps <= 3.29.10 versions.CVE-2026-666637.1Unauthenticated Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions.CVE-2026-666647.1Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.0 versions.CVE-2026-6666510.0Unauthenticated Arbitrary File Upload in Type Hub <= 2.0.6 versions.CVE-2026-666666.9Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data. This issueCVE-2026-666677.1Unauthenticated Cross Site Scripting (XSS) in Templately <= 3.7.1 versions.CVE-2026-666688.5Subscriber SQL Injection in Community by PeepSo <= 9.0.5.2 versions.CVE-2026-66674.3PgBouncer before 1.25.2 did not perform an appropriate authorization check for the KILL_CLIENT admin command. All users with access to the aCVE-2026-666708.1Unauthenticated Local File Inclusion in Måne <= 1.7 versions.
CVE-2026-66659: Critical severity, CVSS 9.3 | Vulnix