CVE-2026-105472

A SQL injection vulnerability exists in the Booking Handler component of the girishsaraf Online-Appointment-Booking-System (versions up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5 ). The flaw is located within an unknown function in the book.php file, where the manipulation of the Doctor/appointm...

CVE-2026-105471

A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Impacted is an unknown function of the file signup.php of the component Registration Handler. The manipulation of the argument fname results in sql injection. The...

CVE-2026-79811: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in the API of ClearPass Policy Manager could allow a remote authenticated attacker with administrative privileges to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to execute arbitrary...

PT-2026-106335

A flaw has been found in bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL up to ae783195ba7e0390d3b3bfaddd99944b7e9735a4. Affected by this vulnerability is an unknown functionality of the file /admin transaction.php. This manipulation of the argument Username causes sql...

RockyLinux 8 : mariadb-connector-c (RLSA-2026:75674)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:75674 advisory. mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysqlrealescapestring CVE-2026-44172 Tenable has extracted...

RockyLinux 9 : mariadb-connector-c (RLSA-2026:75673)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:75673 advisory. mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysqlrealescapestring CVE-2026-44172 Tenable has extracted...

CVE-2026-39785: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Serhii Pasyuk Gmedia Photo Gallery grand-media allows Blind SQL Injection.This issue affects Gmedia Photo Gallery: from n/a through 1.25.1...

PT-2026-107169

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description When the built-in SSH server is enabled via the START SSH SERVER variable, the system performs a lookup of the presented public key using an SQL LIKE comparison of its encoded content. Because...

AlmaLinux 9 : mariadb-connector-c (ALSA-2026:75673)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:75673 advisory. mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysqlrealescapestring CVE-2026-44172 Tenable has extracted t...

PT-2026-106473

Subscriber SQL Injection in ListingPro = 2.9.12 versions...

PT-2026-106476

Unauthenticated SQL Injection in ARMember Premium = 7.8 versions...

PT-2026-106485

SQL injection SQLi vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/ajax/users.php?op=verify'. The parameter is vulnerable to boolean-based and time-based SQL injection. Successfully exploiting this vulnerability would allow an...

PT-2026-106406

Name of the Vulnerable Software and Affected Versions WooCommerce Lottery versions prior to 2.3.0 Description An unauthenticated SQL Injection exists in the software. SQL Injection is a type of vulnerability that allows an attacker to interfere with the queries that an application makes to its...

PT-2026-106389

Subscriber SQL Injection in Paid Member Subscriptions = 3.1.1 versions...

PT-2026-106436

Name of the Vulnerable Software and Affected Versions Radius Booking — Booking Calendar for Appointments & Services versions prior to 1.0.20 Description An unauthenticated SQL Injection exists in the software. SQL Injection is a type of vulnerability that allows an attacker to interfere with the...

PT-2026-106420

Name of the Vulnerable Software and Affected Versions Booknetic versions prior to 4.8.6 Description An unauthenticated SQL Injection exists in the software. SQL Injection is a type of vulnerability that allows an attacker to interfere with the queries that an application makes to its database,...

PT-2026-106758

A vulnerability was identified in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This affects an unknown function of the file search class.php. Such manipulation of the argument school year leads to sql injection. The attack may be launched remotely. The...

PT-2026-106820

Name of the Vulnerable Software and Affected Versions LogicalDOC Enterprise versions prior to 9.1.2 Description An authenticated user can manipulate SQL queries through a crafted workflow template name in the WorkflowsDataServlet component. This leads to a blind SQL injection, a technique used to...

PT-2026-106421

Name of the Vulnerable Software and Affected Versions Woffice versions prior to 5.4.36 Description An SQL Injection issue exists in the subscriber component, allowing an attacker to interfere with the database queries. Recommendations Update to a version newer than 5.4.35...

CVE-2026-105845: Improper Neutralization of Special Elements used in an SQL Command

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query readable collections through dynamic filters or joins can submit a request that causes SQL injection in the SQLite...