CVE-2026-19973

A vulnerability was found in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /viewpaymentreport.php. Performing a manipulation of the argument delid results in sql injection. It is possible to initiate the attack remotely. The...

Exploit for CVE-2026-74251

Unauthenticated SQL Injection via Attribute Filter in Phoca Ca...

CVE-2026-19973 itsourcecode Hospital Management System viewpaymentreport.php sql injection

A vulnerability was found in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /viewpaymentreport.php. Performing a manipulation of the argument delid results in sql injection. It is possible to initiate the attack remotely. The...

CVE-2026-19973

A vulnerability was found in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /viewpaymentreport.php. Performing a manipulation of the argument delid results in sql injection. It is possible to initiate the attack remotely. The...

CVE-2026-19973

CVE-2026-19973 affects itsourcecode Hospital Management System 1.0. An SQL injection vulnerability exists in the unknown functionality of /viewpaymentreport.php when manipulating the delid parameter, exploitable remotely. Public exploit is indicated. CVSS metrics from VulDB suggest a medium sever...

EUVD-2026-60024

A vulnerability was found in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /viewpaymentreport.php. Performing a manipulation of the argument delid results in sql injection. It is possible to initiate the attack remotely. The...

CVE-2026-19972

CVE-2026-19972 affects itsourcecode Hospital Management System 1.0, with SQL injection in an unknown function of /viewpatient.php via the delid parameter. Remote exploitation is possible, and public disclosure of the exploit is noted. Metrics indicate PoC exploit maturity (CVSS v4.0: 5.3 base, NE...

EUVD-2026-60023

A vulnerability has been found in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /viewpatient.php. Such manipulation of the argument delid leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and ma...

CVE-2026-19972

A vulnerability has been found in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /viewpatient.php. Such manipulation of the argument delid leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and ma...

CVE-2026-51346

StudIP (learning management system) has a SQL injection in its store() functions, affecting 6.0.x before 6.0.3 and 5.4.x before 5.4.12. CVSS 9.1 (network, no auth) allows unauthenticated remote attackers to execute arbitrary code and exfiltrate data. CISA SSVC flags it as PoC, automatable, total ...

PT-2026-76864

SQL Injection vulnerability in Qcms v.6.0.6 allows a remote attacker to execute arbitrary code...

CVE-2026-51346

SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive information via the store functions...

CVE-2026-50769

The CRM+ application before and including version 2025.6 from Brainformatik is vulnerable to SQL Injection time-based vulnerability. The check conflict endpoint index.php?module=Appointments&action=CheckConflictOfDates&ajaxSkipHeader=true which is used to check any conflicts for user calendar is...

CVE-2026-51346

SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive information via the store functions...

EUVD-2026-60535

zuraCast versions up to and including 0.23.7 contain a SQL injection vulnerability in the backup restore functionality. The azuracast:restore command executes the db.sql file extracted from a backup archive without any content validation or sanitization. This allows a remote attacker to escalate...

EUVD-2026-60312

SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive information via the store functions...

EUVD-2026-60357

The CRM+ application before and including version 2025.6 from Brainformatik is vulnerable to SQL Injection time-based vulnerability. The check conflict endpoint index.php?module=Appointments&action=CheckConflictOfDates&ajaxSkipHeader=true which is used to check any conflicts for user calendar is...

CVE-2026-67854

Qcms v6.0.6 is vulnerable to a SQL injection in its backend, allowing a remote attacker to execute arbitrary code. The vulnerability was identified in a white-box audit report; no patch or affected component details are provided in the available documents. Exploitation status is not reported. See...

CVE-2026-67854

SQL Injection vulnerability in Qcms v.6.0.6 allows a remote attacker to execute arbitrary code...

CVE-2026-50769

The CRM+ application (version 2025.6 and earlier) by Brainformatik is vulnerable to time-based SQL injection in the CheckConflictOfDates endpoint (index.php?module=Appointments&action=CheckConflictOfDates&ajaxSkipHeader=true), which could allow an attacker to execute arbitrary code. No exploit or...