PT-2026-111061

Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers can send specially crafted requests to inject SQL into database queries and extract sensitive information from the underlying...

CVE-2026-108805: Improper Neutralization of Special Elements used in an SQL Command

A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this vulnerability is the function mysqlquery of the file source/loginprocessing.php of the component Login Handler. This manipulation of the argument email/password causes sq...

CVE-2026-109634: Improper Neutralization of Special Elements used in an SQL Command

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers with high privileges can send specially crafted requests to these endpoints to inject SQL and extract sensitive information fro...

CVE-2026-108806: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this issue is the function mysqlquery of the file source/authprocessing.php of the component Forgot Password Handler. Such manipulation of the argument fpemail leads ...

PT-2026-110770

Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 26.9.0 Description An SQL injection issue exists where unprivileged users can execute arbitrary SQL commands. This is achieved by providing an array-valued notification id parameter to the 'notifications.inc.php'...

EulerOS 2.0 SP11 : apr-util (EulerOS-SA-2026-4302)

According to the versions of the apr-util packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility:...

PT-2026-111047

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.121.0 Frappe ERPNext versions 16.x prior to 16.34.0 Description Missing input validation in certain endpoints allows authenticated attackers with high privileges to execute SQL injection. By sending speciall...

PT-2026-111012

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.9 Description An SQL injection issue exists in the PdoMysql::escape function. When MySQL or MariaDB is configured in NO BACKSLASH ESCAPES mode, single quotes are escaped with backslashes that the database treats ...

CVE-2026-109631: Improper Neutralization of Special Elements used in an SQL Command

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation, allowing crafted input to alter database queries. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to...

CVE-2026-108828: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in Zen Cart 2.2.2. Affected by this vulnerability is the function eval of the file admin/configuration.php of the component Admin Panel. The manipulation of the argument gID leads to sql injection. The attack may be initiated remotely. The attack is considered to ha...

CVE-2026-108900: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in Exponent CMS up to 3.0.2patch2. Affected is the function userLogin of the file xmlrpc.php of the component XML-RPC. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be use...

CVE-2026-108777: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in erzhongxmu JEEWMS up to 2026.09.27-W39. This affects the function WvGiController.list of the file src/main/java/com/zzjee/wmapi/controller/WvGiController.java. The manipulation of the argument searchstr results in sql injection. The attack can be executed remotely. Th...

CVE-2026-109649: Improper Neutralization of Special Elements used in an SQL Command

Frappe ERPNext before 15.102.0 and 16.x before 16.11.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers can send specially crafted requests to the affected endpoints to extract sensitive...

CVE-2026-109674: Improper Neutralization of Special Elements used in an SQL Command

Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints caused by missing input validation. Remote authenticated attackers can send specially crafted requests to the affected endpoints to manipulate database queries and extract sensitive...

CVE-2026-108775: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in erzhongxmu JEEWMS up to 2026.09.27-W39. The impacted element is the function WvNoticeController.list of the file com/zzjee/wmapi/controller/WvNoticeController.java of the component Search Endpoint. The manipulation of the argument searchstr leads to sql injection...

VulnCheck KEV: CVE-2026-0702

The VidShop – Shoppable Videos for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'fields' parameter in all versions up to, and including, 1.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-109080: Improper Neutralization of Special Elements used in an SQL Command

SQL injection in the bulk license plate search of the Flock Night Shift hosted service allowed an authenticated user to read other customer organizations' data, including license plate recognition records, via a crafted license plate value. Data could not be modified. Flock identified the issue...

CVE-2026-1907: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection SQLi affects the Kong Gateway Enterprise and Open Source clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane CP, leading to potential unauthorized database access. Leveraging the...

PT-2026-110899

Name of the Vulnerable Software and Affected Versions itsourcecode Baptism Information Management System version 1.0 Description A remote SQL injection flaw exists in the ebaptism.php file. This issue occurs when the ID argument is manipulated, allowing an attacker to execute arbitrary SQL comman...

PT-2026-110513

Name of the Vulnerable Software and Affected Versions Kong Gateway versions prior to 3.9.4 Description A SQL Injection SQLi exists in the clustering communication logic of Kong Gateway Enterprise and Open Source when operating in Hybrid Mode. An attacker can trigger this issue by sending speciall...