219690 matches found
CVE-2026-69240
A flaw was found in Sequelize. When configured to use an Oracle database, the Sequelize Node.js Object-Relational Mapper ORM tool fails to properly escape certain date and timestamp values. This oversight allows a remote attacker to bypass security filters. By injecting malicious SQL commands, an...
CVE-2026-19021
A security vulnerability has been detected in SourceCodester Computer Repair Shop Management System 1.0. Affected by this issue is some unknown functionality of the file /classes/Master.php?f=deleteproduct. Such manipulation of the argument ID leads to sql injection. It is possible to launch the...
CVE-2026-19020
A weakness has been identified in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /servicetype.php. This manipulation of the argument editid causes sql injection. It is possible to initiate the attack remotely. The exploit has be...
CVE-2026-19021
A security vulnerability has been detected in SourceCodester Computer Repair Shop Management System 1.0. Affected by this issue is some unknown functionality of the file /classes/Master.php?f=deleteproduct. Such manipulation of the argument ID leads to sql injection. It is possible to launch the...
CVE-2026-19021 SourceCodester Computer Repair Shop Management System Master.php delete_product sql injection
A security vulnerability has been detected in SourceCodester Computer Repair Shop Management System 1.0. Affected by this issue is some unknown functionality of the file /classes/Master.php?f=deleteproduct. Such manipulation of the argument ID leads to sql injection. It is possible to launch the...
EUVD-2026-53825
A security vulnerability has been detected in SourceCodester Computer Repair Shop Management System 1.0. Affected by this issue is some unknown functionality of the file /classes/Master.php?f=deleteproduct. Such manipulation of the argument ID leads to sql injection. It is possible to launch the...
CVE-2026-19020 itsourcecode Hospital Management System servicetype.php sql injection
A weakness has been identified in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /servicetype.php. This manipulation of the argument editid causes sql injection. It is possible to initiate the attack remotely. The exploit has be...
EUVD-2026-53824
A weakness has been identified in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /servicetype.php. This manipulation of the argument editid causes sql injection. It is possible to initiate the attack remotely. The exploit has be...
CVE-2026-16065
The Welcart e-Commerce WordPress plugin before 2.11.32 does not properly sanitise a value taken from an imported CSV file before using it in a SQL statement, allowing users with the Editor role and above including its custom shop-management roles to perform SQL injection attacks...
EUVD-2026-53734
The WPCargo Track & Trace WordPress plugin before 8.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks. This affects a code path distinct from the one addressed by CVE-2024-44004...
EUVD-2026-53731
The Welcart e-Commerce WordPress plugin before 2.11.32 does not properly sanitise a value taken from an imported CSV file before using it in a SQL statement, allowing users with the Editor role and above including its custom shop-management roles to perform SQL injection attacks...
CVE-2026-16065
CVE-2026-16065 affects the Welcart e-Commerce WordPress plugin prior to 2.11.32. The issue is a lack of sanitisation of a value from an imported CSV file used in a SQL statement, enabling SQL injection by users with Editor role or higher (including custom shop-management roles). Reported CVSSv3.1...
CVE-2026-16065
The Welcart e-Commerce WordPress plugin before 2.11.32 does not properly sanitise a value taken from an imported CSV file before using it in a SQL statement, allowing users with the Editor role and above including its custom shop-management roles to perform SQL injection attacks...
EUVD-2026-53697
A flaw has been found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. The affected element is an unknown function of the file /dm/dispatch/user/findAll. Executing a manipulation of the argument Name can lead to sql injection. It is possible to launch the attack...
CVE-2026-18970
A flaw has been found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. The affected element is an unknown function of the file /dm/dispatch/user/findAll. Executing a manipulation of the argument Name can lead to sql injection. It is possible to launch the attack...
VulnCheck KEV: CVE-2026-72898
Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/resetpassword' database endpoint and gain administrator access to the connected Metabase instance...
Linux Distros Unpatched Vulnerability : CVE-2026-69240
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Sequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if dialect is set to oracle. The escape function defined in...
CVE-2026-67689
CVE-2026-67689 concerns FineAdmin V1.0 where the vulnerability arises in the paginated list endpoints through the field and order parameters, enabling SQL injection via unsafely constructed ORDER BY clauses. Connected sources describe that FineAdmin.Mvc’s GetListByFilter()/GetPageUnite() concaten...
SUSE SLES15: apache2-mod_php7 / php7 / php7-bcmath / php7-bz2 / php7-calendar / etc (SUSE-SU-2026:3510-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3510-1 advisory. - CVE-2026-7260: Stack overflow in phar with circular symlinks bsc1273077. - CVE-2026-9672: Upgrade libgd bsc1273078. -...