PT-2026-99048

Name of the Vulnerable Software and Affected Versions CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be Description A remote SQL injection exists in the managevideos2.php file. This issue occurs when the editassid argument is manipulated, allowing an attacker to...

PT-2026-98955

Name of the Vulnerable Software and Affected Versions CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be Description A SQL injection flaw exists in the Faculty Authentication component within the loginlinkfaculty.php file. A remote attacker can exploit this by...

PT-2026-98960

Name of the Vulnerable Software and Affected Versions CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be Description A remote SQL injection exists within the Student Update Functionality component in the updatestudent.php file. The issue occurs when the eno argumen...

PT-2026-98892

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 16.4.0 Description The check upgrade access rights function in admin/include/functions upgrade.php conditionally escapes the submitted username only if the get magic quotes gpc function exists. In PHP 8 and later, wher...

Linux Distros Unpatched Vulnerability : CVE-2026-96883

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pgcollection is an open source extension to PostgreSQL. A type confusion issue in AWS pgcollection 2.0.0 through 2.1.1 might allow an authenticated remote user ...

PT-2026-99074

Name of the Vulnerable Software and Affected Versions GLPI versions 9.4.0 through 10.0.25 GLPI versions 11.0.0 through 11.0.7 Description An attacker with READ permissions on logs can craft a URL for the history tab to inject controlled values into a database query. This leads to SQL injection, a...

CVE-2026-53629: Improper Neutralization of Special Elements used in an SQL Command

GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, an attacker with the READ right on logs can craft a URL for the history tab that injects attacker-controlled values into a database query. This permits SQL injection through the history tab endpoint. Thi...

CVE-2026-97883: Improper Neutralization of Special Elements used in an SQL Command

A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This affects an unknown function of the file updatequery.php. The manipulation of the argument gid leads to sql injection. The attack can be initiated remotely. Th...

CVE-2026-97884: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file updatestudent.php of the component Student Update Functionality. The manipulation of the argument eno results in sql injection. The...

PT-2026-98875

Name of the Vulnerable Software and Affected Versions InvoicePlane versions prior to 1.7.2 Description InvoicePlane fails to perform strict integer validation on the tax rate decimal places setting, which is controlled by the administrator. This value is interpolated into an ALTER TABLE statement...

Linux Distros Unpatched Vulnerability : CVE-2026-92692

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affected Sulu 2.6 and 3.0 release lines have...

PT-2026-98878

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 16.4.0 Description The application fails to perform numeric validation on dimension width, height, ratio, and filesize values provided via the Batch Manager filter URL in the 'admin/batch manager.php' endpoint. These...

CVE-2026-96883

pgcollection is an open source extension to PostgreSQL. A type confusion issue in AWS pgcollection 2.0.0 through 2.1.1 might allow an authenticated remote user to execute arbitrary code as the postgres operating system user via crafted SQL statements that rely on mismatched type metadata in...

UBUNTU-CVE-2026-96883

pgcollection is an open source extension to PostgreSQL. A type confusion issue in AWS pgcollection 2.0.0 through 2.1.1 might allow an authenticated remote user to execute arbitrary code as the postgres operating system user via crafted SQL statements that rely on mismatched type metadata in...

CVE-2026-96883

pgcollection is an open source extension to PostgreSQL. A type confusion issue in AWS pgcollection 2.0.0 through 2.1.1 might allow an authenticated remote user to execute arbitrary code as the postgres operating system user via crafted SQL statements that rely on mismatched type metadata in...

DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution

Summary DBHub 0.21.2 exposes an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport mode, for example --transport http --port 8080. The HTTP server attempts to protect browser-origin access by checking whether the Origin hostname equals the Host hostname, then...

GHSA-FM8P-53WW-HF6W DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution

Summary DBHub 0.21.2 exposes an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport mode, for example --transport http --port 8080. The HTTP server attempts to protect browser-origin access by checking whether the Origin hostname equals the Host hostname, then...

phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion

Summary The StopWords::add method in phpMyFAQ builds a SQL INSERT statement using sprintf and inserts the user-supplied stop word value directly into the query string without calling the application's database escaping function on it. A sibling method, StopWords::update, which modifies an existin...

SQL Injection

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to SQL Injection in the add function. An attacker can execute arbitrary SQL commands by submitting crafted input as the word parameter in the stop-word...

SQL Injection

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to SQL Injection in the add function. An attacker can execute arbitrary SQL commands by submitting crafted input as the word parameter in the stop-word...