CVE-2026-96777

A SQL injection vulnerability exists in Forma LMS versions up to 4.1.43 . The flaw is located in the Multi-User-Selector AJAX Endpoint , specifically within the UserselectorAdmController::getDataTask function of the file /appCore/ajax.adm_server.php?r=adm/userselector/getData. An attacker can ini...

EUVD-2026-85778

A vulnerability was determined in Forma LMS up to 4.1.43. This impacts the function UserselectorAdmController::getDataTask of the file /appCore/ajax.admserver.php?r=adm/userselector/getData of the component Multi-User-Selector AJAX Endpoint. This manipulation of the argument Name causes sql...

Exploit for Interpretation Conflict in Wordpress

WP2Shell — CVE-2026-63030 + CVE-2026-60137 WordPress Core Pre-...

EUVD-2026-85749

A vulnerability has been found in pmTicket Project-Management-Software up to 078fa56a782490c5059a0814f84df27984f4d7e2. This affects the function setSync of the file /ajax/addproject.php. Such manipulation of the argument connsettings leads to sql injection. The attack may be launched remotely. Th...

EUVD-2026-85675

A flaw has been found in Abdurrab5 online-makeup-store. This impacts an unknown function of the file customerSignin.php of the component Customer Login Handler. This manipulation of the argument username/password causes sql injection. The attack is possible to be carried out remotely. The exploit...

EUVD-2026-85674

A vulnerability was detected in Abdurrab5 online-makeup-store. This affects an unknown function of the file index.php of the component Admin Login Handler. The manipulation of the argument id/password results in sql injection. The attack can be executed remotely. The exploit is now public and may...

EUVD-2026-85711

A vulnerability was identified in SoftNews Media Group DataLife Engine 18.0. This affects the function stripdata of the file engine/modules/search.php of the component Search Module. The manipulation of the argument story leads to sql injection. The attack can be initiated remotely. The exploit i...

CVE-2026-96751

A vulnerability has been found in pmTicket Project-Management-Software up to 078fa56a782490c5059a0814f84df27984f4d7e2. This affects the function setSync of the file /ajax/addproject.php. Such manipulation of the argument connsettings leads to sql injection. The attack may be launched remotely. Th...

PT-2026-97838

Name of the Vulnerable Software and Affected Versions IBM Enterprise Build of Quarkus versions 3.27.1 through 3.27.5.SP1 IBM Enterprise Build of Quarkus versions 3.33.1 through 3.33.3.SP1 Description An issue exists where a remote unauthenticated attacker can execute SQL injection by sending...

CVE-2026-56738: Improper Neutralization of Special Elements used in an SQL Command

phpMyFAQ is an open source FAQ web application. The StopWords::add method inversions prior to 4.1.6 builds a SQL INSERT statement using sprintf and inserts the user-supplied stop word value directly into the query string without calling the application's database escaping function on it. A siblin...

PT-2026-98153

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.8 Discourse versions prior to 2026.6.3 Discourse versions prior to 2026.7.2 Discourse versions prior to 2026.8.0 Description Authenticated users can provide unescaped SQL LIKE metacharacters to...

CVE-2026-80513: Deserialization of Untrusted Data

The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP chain is present in the wpForo Forum...

PT-2026-97730

Name of the Vulnerable Software and Affected Versions DIAEnergie versions prior to 1.11.00.022 Description SQL Injection in DIAEnergie. SQL Injection is a type of vulnerability that allows an attacker to interfere with the queries that an application makes to its database. Recommendations Update ...

CVE-2026-61788: Incomplete List of Disallowed Inputs

DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to version 0.22.6, setting readonly = true on the executesql tool does not make the connection read-only. The connectors are written to set PostgreSQL defaulttransactionreadonly=on and open SQLite in...

PT-2026-97732

Name of the Vulnerable Software and Affected Versions DIAEnergie versions prior to 1.11.00.022 Description SQL Injection in DIAEnergie. SQL Injection is a type of vulnerability that allows an attacker to interfere with the queries that an application makes to its database. Recommendations Update ...

PT-2026-97683

Name of the Vulnerable Software and Affected Versions Forma LMS versions prior to 4.1.44 Description A SQL injection issue exists in the Multi-User-Selector AJAX Endpoint. This occurs when the Name argument is manipulated within the UserselectorAdmController::getDataTask function, located in the...

PT-2026-97684

Name of the Vulnerable Software and Affected Versions java110 MicroCommunity versions prior to 2.1 Description Remote manipulation of the fallBackSql argument within the QueryServiceSMOImpl.fallBack function of the BusinessApi.java file in the fallBack API endpoint allows for SQL injection. SQL...

CVE-2026-97321: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The impacted element is the function GoViewDataServiceImpl.getDataBySQL of the file yudao-module-report/src/main/java/cn/iocoder/yudao/module/report/service/goview/GoViewDataServiceImpl.java of the component GoVie...

CVE-2026-13016: Improper Neutralization of Special Elements used in an SQL Command

ServiceNow has remediated a SQL injection vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gain access to, or modif...

CVE-2026-78311: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection vulnerability in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022...