CVE-2026-16490

A security flaw has been discovered in itsourcecode Hospital Management System 1.0. Impacted is an unknown function of the file /prescription.php. The manipulation of the argument editid results in sql injection. The attack can be executed remotely. The exploit has been released to the public and...

CVE-2026-16490 itsourcecode Hospital Management System prescription.php sql injection

A security flaw has been discovered in itsourcecode Hospital Management System 1.0. Impacted is an unknown function of the file /prescription.php. The manipulation of the argument editid results in sql injection. The attack can be executed remotely. The exploit has been released to the public and...

RHEL 10 : mariadb-connector-c (RHSA-2026:43505)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:43505 advisory. The MariaDB Native Client library C driver is used to connect applications developed in C/C++ to MariaDB and MySQL databases. Security Fixes:...

Plone 4.0.x < 4.3.20 / 5.0.x < 5.1.7 / 5.2.x < 5.2.2 Multiple Vulnerabilities (HF 20200121)

The version of Plone installed on the remote host is 4.0.x prior to 4.3.20, 5.0.x prior to 5.1.7, or 5.2.x prior to 5.2.2. It is, therefore, affected by the following vulnerabilities: - An open redirect on the login form and possibly other places allows an attacker to craft a link to a Plone Site...

Tenable Security Center Multiple Vulnerabilities (TNS-2026-19)

According to its self-reported version, the Tenable Security Center running on the remote host is between 6.6.0 and 6.8.0. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2026-19 advisory. - Tenable Security Center is affected by a SQL injection vulnerability...

CVE-2026-61128

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are MySQL Server: 9.7.0-9.7.1; MySQL Cluster: 9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple...

CVE-2026-60840

Vulnerability in the Oracle Demand Signal Repository product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Demand...

CVE-2026-16484

A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /editsubjecta.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published...

EUVD-2026-46431

Aptabase through commit 5a89368 contains a SQL injection vulnerability in the ClickHouse query backend that allows authenticated attackers to read event data across all tenants by injecting unsanitized filter parameters into Liquid SQL templates. Attackers can supply malicious values through...

CVE-2026-16484

SourceCodester Class and Exam Timetabling System 1.0 is affected by a SQL injection in the /edit_subjecta.php parameter ID. The vulnerability arises from manipulating the ID argument, enabling remote exploitation. The exploit has been published and may be used. CVSS metrics in the entry indicate ...

CVE-2026-63080

Aptabase through commit 5a89368 contains a SQL injection vulnerability in the ClickHouse query backend that allows authenticated attackers to read event data across all tenants by injecting unsanitized filter parameters into Liquid SQL templates. Attackers can supply malicious values through...

CVE-2026-52469

SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the DeviceInfoMapper.xml file...

CVE-2026-63080

Aptabase (through commit 5a89368) contains a SQL injection vulnerability in the ClickHouse query backend that allows authenticated attackers to read event data across all tenants by injecting unsanitized filter parameters into Liquid SQL templates. The attack can be carried out by supplying malic...

CVE-2016-20096

Linknat VOS3000 and VOS2009 through version 2.1.2.0 contain an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands by manipulating the name parameter in a POST request to the login endpoint. Attackers can inject malicious SQL through the logi...

CVE-2026-55082

Summary: CVE-2026-55082 affects DHIS2 SQL View filters. An authenticated user who has SQL View access could supply crafted filter values that are interpolated into generated SQL, allowing manipulation of SQL generated for SQL View filters and potentially accessing data outside the intended SQL Vi...

CVE-2026-55084 SQL Injection in SqlView Filter Parameter Leading to Arbitrary Database Read

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. A SQL injection vulnerability was identified in the SqlView API endpoint of the DHIS2 application in the filter parameter used by the /api/sqlViews/viewId/data.json endpoint. An...

CVE-2026-55084

DHIS2 has a SQL injection vulnerability in the SqlView filter parameter of the /api/sqlViews/{viewId}/data.json endpoint. An authenticated SqlView user can inject arbitrary SQL through the filter, with output reflected in an error message, enabling error-based SQL extraction of database content. ...

CVE-2026-64877

An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database...

CVE-2026-64877

CVE-2026-64877 is an authenticated, non-admin SQL injection vulnerability in the appliance’s ticketing REST API that can lead to access to sensitive data stored in the appliance database. The CVSS v3.1 base score is 9.6 (CRITICAL) with network attack vector, low attack complexity, and privileges ...

EUVD-2026-46317

A SQL injection CWE-89 and security boundary bypass CWE-863 vulnerability exists in the prebuilt BigQuery forecasting tool bigquery-forecast of googleapis/mcp-toolbox. The tool accepts client-controlled parameters datacol, timestampcol, and idcols as plain strings and interpolates them unescaped...