283219 matches found
CVE-2022-4997: Improper Neutralization of Special Elements used in an SQL Command
The jet-form-builder-stripe-gateway WordPress plugin before 1.1.0 does not sanitise and escape a payment token before using it in a SQL statement, allowing unauthenticated users to extract arbitrary data from the database, including password hashes...
PT-2026-97125
Name of the Vulnerable Software and Affected Versions SourceCodester Online Reviewer Management System version 1.0 Description A remote SQL injection is possible due to improper handling of the test id argument within an unknown function in the '/reviewer 0/admins/assessments/pretest/btn...
CVE-2026-95833 itsourcecode Leave Management System index.php sql injection
A weakness has been identified in itsourcecode Leave Management System 1.0. Impacted is an unknown function of the file /module/leavetype/index.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public a...
CVE-2026-95833 itsourcecode Leave Management System index.php sql injection
A weakness has been identified in itsourcecode Leave Management System 1.0. Impacted is an unknown function of the file /module/leavetype/index.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public a...
CVE-2026-95833
A SQL injection vulnerability exists in the itsourcecode Leave Management System 1.0 . The flaw is located in an unknown function within the file /module/leavetype/index.php , where a lack of proper input validation on the ID argument allows an attacker to execute arbitrary SQL commands. This vul...
CVE-2026-61685
ReactPress is a publishing system for React developers. Prior to version 3.7.0, ReactPress API list endpoints build TypeORM QueryBuilder conditions using unsanitized HTTP query parameter names as SQL column identifiers e.g. article.$key . TypeORM parameterizes values but not column names, allowin...
CVE-2026-95829
The TDuckCloud tduck-platform (up to version 5.3) contains a SQL injection vulnerability within the Pagination Inner Interceptor component. Specifically, the PaginationInnerInterceptor.concatOrderBy function in the file tduck-api/src/main/java/com/tduck/cloud/api/config/MybatisPlusConfig.java fai...
CVE-2026-95829 TDuckCloud tduck-platform Pagination Inner Interceptor MybatisPlusConfig.java PaginationInnerInterceptor.concatOrderBy sql injection
A vulnerability was identified in TDuckCloud tduck-platform up to 5.3. This vulnerability affects the function PaginationInnerInterceptor.concatOrderBy of the file tduck-api/src/main/java/com/tduck/cloud/api/config/MybatisPlusConfig.java of the component Pagination Inner Interceptor. The...
CVE-2026-95829 TDuckCloud tduck-platform Pagination Inner Interceptor MybatisPlusConfig.java PaginationInnerInterceptor.concatOrderBy sql injection
A vulnerability was identified in TDuckCloud tduck-platform up to 5.3. This vulnerability affects the function PaginationInnerInterceptor.concatOrderBy of the file tduck-api/src/main/java/com/tduck/cloud/api/config/MybatisPlusConfig.java of the component Pagination Inner Interceptor. The...
CVE-2026-95829 TDuckCloud tduck-platform Pagination Inner Interceptor MybatisPlusConfig.java PaginationInnerInterceptor.concatOrderBy sql injection
A vulnerability was identified in TDuckCloud tduck-platform up to 5.3. This vulnerability affects the function PaginationInnerInterceptor.concatOrderBy of the file tduck-api/src/main/java/com/tduck/cloud/api/config/MybatisPlusConfig.java of the component Pagination Inner Interceptor. The...
CVE-2026-61685
ReactPress , a publishing system for React developers, is vulnerable to SQL injection in versions prior to 3.7.0 . The issue exists in the API list endpoints where TypeORM QueryBuilder conditions are constructed using unsanitized HTTP query parameter names as SQL column identifiers (e.g., `articl...
CVE-2026-61685 ReactPress has SQL injection via dynamic column names in TypeORM query builders
ReactPress is a publishing system for React developers. Prior to version 3.7.0, ReactPress API list endpoints build TypeORM QueryBuilder conditions using unsanitized HTTP query parameter names as SQL column identifiers e.g. article.$key . TypeORM parameterizes values but not column names, allowin...
CVE-2026-61685 ReactPress has SQL injection via dynamic column names in TypeORM query builders
ReactPress is a publishing system for React developers. Prior to version 3.7.0, ReactPress API list endpoints build TypeORM QueryBuilder conditions using unsanitized HTTP query parameter names as SQL column identifiers e.g. article.$key . TypeORM parameterizes values but not column names, allowin...
CVE-2026-61685 ReactPress has SQL injection via dynamic column names in TypeORM query builders
ReactPress is a publishing system for React developers. Prior to version 3.7.0, ReactPress API list endpoints build TypeORM QueryBuilder conditions using unsanitized HTTP query parameter names as SQL column identifiers e.g. article.$key . TypeORM parameterizes values but not column names, allowin...
CVE-2026-95819
A vulnerability has been found in anirbandutta9 College-Notes-Gallery up to 8c1cf3d98f30982d069c88ca172612c001eb39f6. Affected by this vulnerability is an unknown functionality of the file login.php. Such manipulation of the argument user/pass leads to sql injection. The attack may be performed...
CVE-2026-95819 anirbandutta9 College-Notes-Gallery login.php sql injection
A vulnerability has been found in anirbandutta9 College-Notes-Gallery up to 8c1cf3d98f30982d069c88ca172612c001eb39f6. Affected by this vulnerability is an unknown functionality of the file login.php. Such manipulation of the argument user/pass leads to sql injection. The attack may be performed...
CVE-2026-95819 anirbandutta9 College-Notes-Gallery login.php sql injection
A vulnerability has been found in anirbandutta9 College-Notes-Gallery up to 8c1cf3d98f30982d069c88ca172612c001eb39f6. Affected by this vulnerability is an unknown functionality of the file login.php. Such manipulation of the argument user/pass leads to sql injection. The attack may be performed...
CVE-2026-95819
A SQL injection vulnerability exists in the login.php file of anirbandutta9 College-Notes-Gallery (up to commit 8c1cf3d98f30982d069c88ca172612c001eb39f6). The root cause is the improper handling of the user/pass arguments, allowing for remote manipulation. The exploit has been disclosed to the pu...
