CVE-2026-62262: Improper Neutralization of Special Elements used in an SQL Command

Piwigo is a full featured open source photo gallery application for the web. In 17.0.0beta1 and earlier, when rating is enabled, an unauthenticated guest can call pwg.images.filteredSearch.create with a crafted ratings value and then open the returned search URL. include/wsfunctions/pwg.images.ph...

CVE-2026-97884: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file updatestudent.php of the component Student Update Functionality. The manipulation of the argument eno results in sql injection. The...

PT-2026-99048

Name of the Vulnerable Software and Affected Versions CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be Description A remote SQL injection exists in the managevideos2.php file. This issue occurs when the editassid argument is manipulated, allowing an attacker to...

CVE-2026-97882: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function of the file loginlinkfaculty.php of the component Faculty Authentication. Executing a manipulation of the argument fid/pass can lea...

PT-2026-99074

Name of the Vulnerable Software and Affected Versions GLPI versions 9.4.0 through 10.0.25 GLPI versions 11.0.0 through 11.0.7 Description An attacker with READ permissions on logs can craft a URL for the history tab to inject controlled values into a database query. This leads to SQL injection, a...

PT-2026-98960

Name of the Vulnerable Software and Affected Versions CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be Description A remote SQL injection exists within the Student Update Functionality component in the updatestudent.php file. The issue occurs when the eno argumen...

CVE-2026-97886: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected by this vulnerability is an unknown functionality of the file managevideos2.php. Such manipulation of the argument editassid leads to sql injection. The attack may be...

CVE-2026-33639: Improper Neutralization of Special Elements used in an SQL Command

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane interpolates the administrator-controlled taxratedecimalplaces setting into an ALTER TABLE statement for iptaxrates in Settings::index without strict integer validation...

PT-2026-98955

Name of the Vulnerable Software and Affected Versions CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be Description A SQL injection flaw exists in the Faculty Authentication component within the loginlinkfaculty.php file. A remote attacker can exploit this by...

CVE-2026-53629: Improper Neutralization of Special Elements used in an SQL Command

GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, an attacker with the READ right on logs can craft a URL for the history tab that injects attacker-controlled values into a database query. This permits SQL injection through the history tab endpoint. Thi...

Linux Distros Unpatched Vulnerability : CVE-2026-96883

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pgcollection is an open source extension to PostgreSQL. A type confusion issue in AWS pgcollection 2.0.0 through 2.1.1 might allow an authenticated remote user ...

Linux Distros Unpatched Vulnerability : CVE-2026-92692

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affected Sulu 2.6 and 3.0 release lines have...

frevvomapexec

frevvomapexec frevvomapexec — это скрипт для проверки наличия слепой SQL-инъекции путём внедрения задержки в секундах в Square 9 GlobalForms 6.2. Чтобы убедиться, что уязвимость реальна, конечному пользователю потребуется выполнить математическое вычисление например, вычесть меньшее число из...

CVE-2026-78804_Dolibarr_authenticated_SQL_injection

Dolibarr — 認証済みSQLインジェクションPoC seuilstockalerte パラメータを通じて製品在庫管理機能に影響を与えるSQLインジェクション。 影響を受けるバージョン 以下でテストおよび確認済み: 19.0.4 20.0.4 21.0.4 22.0.5 23.0.3 24.0.0 報告時点まで動作していた。 脆弱なパラメータ seuilstockalerte このパラメータは以下で受け入れられる: /product/stock/product.php addlimitstockwarehouse アクションを使用する。 エクスプロイト...

CVE-2025-26794-exploit

CVE-2025-26794: Exim ETRN SQL 인젝션 익스플로잇 CVE-2025-26794에 대한 개념 증명PoC 익스플로잇 도구로, SQLite DBM 스토리지를 사용할 때 ETRN 명령을 통해 Exim 4.98 메일 서버의 SQL 인젝션 취약점을 시연합니다. ⚠️ 법적 고지 승인된 보안 테스트 전용 이 도구는 교육 목적 및 승인된 침투 테스트용으로만 제공됩니다. 컴퓨터 시스템에 대한 무단 접근은 다음을 포함한 다양한 법률에 따라 불법입니다: 미국의 컴퓨터 사기 및 남용 법안CFAA 영국의 컴퓨터 남용 법안Compute...

CVE-2025-9172

Exploit: /vibes/v1/beacon을 통한 시간 기반 SQL 인젝션 인증 불필요 브라우저 콘솔 PoC async = const url = 'http://localhost/wordpress/index.php?restroute=/vibes/v1/beacon'; async function sendresource const body = type: 'navigation', resource, // injected into SQL unprepared authenticated: 0, metrics: name: 'wait',...

CVE-2024-55099-Online-Nurse-Hiring-System-v1.0-SQL-Injection-Vulnerability-

CVE-2024-55099-Online-Nurse-Hiring-System-v1.0-Уязвимость-SQL-инъекции Автор эксплойта: ugurkarakoc Домашняя страница вендора https://phpgurukul.com/online-nurse-hiring-system-using-php-and-mysql Ссылка на программное обеспечение https://phpgurukul.com/?sdmprocessdownload=1&downloadid=17826 Обзор...

ColorOS-CVE-2025-10184

信息来源 漏洞原理及解决方案技术原理 취약점 설명 유형: 데이터베이스 인젝션 공격 1=1 AND 효과: 임의의 앱에서 SMS 데이터 읽기 가능. 권한 불필요, 사용자 상호작용 불필요, 무감각 읽기 영향: 기기의 모든 SMS 정보, SMS 인증 코드 유출 대상: OPPO 및 그 하위 브랜드OnePlus, realme 영향 범위: maoyixuan이 제출한 기기 목록에 따르면, 2017년 출시된 ColorOS 6.0.1에 취약점이 존재하며, 이 취약점은 OPPO의 OEM 역사를 따라온 것으로 보입니다 수정 상황: 10월 4일부터...

CVE-2026-24417

CVE-2026-24417: OpenSTAManager에 시간 기반 블라인드 SQL 인젝션 및 증폭된 서비스 거부 취약점 존재 개요 필드| 세부정보 ---|--- CVE ID| CVE-2026-24417 심각도| 높음 권고| 권고 보기 발견자| Lukasz Rybak 영향을 받는 제품 devcode-it/openstamanager 버전: 2.9.8 CWE 분류 CWE-89: SQL 명령에 사용되는 특수 요소의 부적절한 중립화 'SQL 인젝션' 세부정보 요약 OpenSTAManager v2.9.8의 여러 검색 모듈 에 영향을 미...

CVE-2026-30655

CVE-2026-30655 — esiclivre의 SQL 삽입 비밀번호 재설정 요약 esiclivre의 비밀번호 재설정 엔드포인트에 SQL 삽입 취약점이 존재합니다. 인증되지 않은 공격자가 cpfcnpj POST 매개변수를 통해 SQL을 주입할 수 있으며, 이로 인해 민감한 정보에 대한 무단 액세스가 발생할 수 있습니다. 영향을 받는 프로젝트 저장소: https://github.com/esiclivre/esiclivre 영향을 받는 버전: v0.2.2 및 이전 버전 영향을 받는 커밋:...