Exploit for CVE-2026-48842

CVE-2026-48842 — Roundcube virtuserquery pre-auth SQLi Pytho...

Multiple vulnerabilities in baserCMS

Overview baserCMS provided by baserCMS User Community contains multiple vulnerabilities listed below: Cross-site scripting CWE-79 - CVE-2026-93460, CVE-2026-93463, CVE-2026-93464 SQL injection CWE-89 - CVE-2026-62956 Missing authentication for critical function CWE-306 - CVE-2026-93462...

sql-injection-labs

SQL Injection Labs — PortSwigger Web Security Academy A colle...

CVE-2026-97885: Improper Neutralization of Special Elements used in an SQL Command

A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file updatefaculty.php. This manipulation of the argument fid causes sql injection. The attack may be initiated remotely. The exploit has been...

CVE-2026-97886: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected by this vulnerability is an unknown functionality of the file managevideos2.php. Such manipulation of the argument editassid leads to sql injection. The attack may be...

CVE-2026-97882: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function of the file loginlinkfaculty.php of the component Faculty Authentication. Executing a manipulation of the argument fid/pass can lea...

CVE-2026-62262: Improper Neutralization of Special Elements used in an SQL Command

Piwigo is a full featured open source photo gallery application for the web. In 17.0.0beta1 and earlier, when rating is enabled, an unauthenticated guest can call pwg.images.filteredSearch.create with a crafted ratings value and then open the returned search URL. include/wsfunctions/pwg.images.ph...

CVE-2026-54790: Improper Neutralization of Special Elements used in an SQL Command

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane stores an administrator-controlled customfieldtable value without validating it against the allowed custom-field table names. Mdlcustomfields::used later concatenates...

CVE-2026-42324: Improper Neutralization of Special Elements used in an SQL Command

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/elementsetranks.php stores administrator-controlled imageorder values without enforcing the existing sort-field whitelist. The stored album imageorder expression is later concatenated into ORDER BY...

CVE-2026-44642: Improper Neutralization of Special Elements used in an SQL Command

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, checkupgradeaccessrights in admin/include/functionsupgrade.php conditionally escapes the submitted username only when the removed getmagicquotesgpc function exists, so PHP 8 and later concatenate an...

CVE-2026-42323: Improper Neutralization of Special Elements used in an SQL Command

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/batchmanager.php accepts administrator-controlled dimension width, height, and ratio values and filesize values from the Batch Manager filter URL without numeric validation. The URL filter parser...

CVE-2026-33639: Improper Neutralization of Special Elements used in an SQL Command

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane interpolates the administrator-controlled taxratedecimalplaces setting into an ALTER TABLE statement for iptaxrates in Settings::index without strict integer validation...

CVE-2026-84893: Improper Neutralization of Special Elements used in an SQL Command

IBM Guardium Data Protection 12.2 is vulnerable to SQL injection in the PESI service. An authenticated attacker could exploit this vulnerability to access sensitive information in the internal database...

CVE-2026-93899: Improper Neutralization of Special Elements used in an SQL Command

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to generic SQL Injection via 'groupid' Message Meta Parameter in all versions up to, and including, 3.0.4 due to insufficient escaping on the user supplied parameter and lack of...

PT-2026-98891

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 16.4.0 Description An authenticated administrator can store a crafted expression via the image order variable in the 'admin/element set ranks.php' endpoint because the application fails to enforce the sort-field...

PT-2026-98857

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description The PESI service contains a SQL injection flaw. An authenticated attacker can exploit this issue to gain unauthorized access to sensitive information stored within the internal database...

PT-2026-98881

Name of the Vulnerable Software and Affected Versions InvoicePlane versions prior to 1.7.2 Description InvoicePlane stores an administrator-controlled custom field table value without validating it against allowed table names. The Mdl custom fields::used function later concatenates this stored...

PT-2026-98376

Name of the Vulnerable Software and Affected Versions Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots versions prior to 3.0.5 Description An issue exists where authenticated users with subscriber-level access and above can perform a generic SQL Injection. This occurs due...

PT-2026-98961

Name of the Vulnerable Software and Affected Versions CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be Description A remote SQL injection exists in the updatefaculty.php file. The issue occurs when the fid argument is manipulated, allowing an attacker to execute...

PT-2026-98956

Name of the Vulnerable Software and Affected Versions mathurvishal CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be Description A remote SQL injection is possible due to the improper handling of the gid argument within an unknown function in the updatequery.php...