CVE-2026-92364 itsourcecode Leave Management System index.php sql injection

A vulnerability has been found in itsourcecode Leave Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /module/employee/index.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit ha...

EUVD-2026-80741

A vulnerability has been found in itsourcecode Leave Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /module/employee/index.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit ha...

CVE-2026-92364

itsourcecode Leave Management System 1.0 is affected by a SQL injection vulnerability in the file /module/employee/index.php, where manipulation of the ID argument allows an attacker to inject SQL commands. The attack can be initiated remotely and requires low privileges (authenticated access), w...

CVE-2026-92364 itsourcecode Leave Management System index.php sql injection

A vulnerability has been found in itsourcecode Leave Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /module/employee/index.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit ha...

CVE-2026-92465

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Themeum WP Mega Menu allows Blind SQL Injection. This issue affects WP Mega Menu: from n/a through 1.4.2...

CVE-2026-92465 WordPress WP Mega Menu plugin <= 1.4.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Themeum WP Mega Menu allows Blind SQL Injection. This issue affects WP Mega Menu: from n/a through 1.4.2...

EUVD-2026-80675

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Themeum WP Mega Menu allows Blind SQL Injection. This issue affects WP Mega Menu: from n/a through 1.4.2...

CVE-2026-92465

Themeum WP Mega Menu (WordPress plugin) is vulnerable to Blind SQL Injection through improper neutralization of special elements in SQL commands. The issue affects versions up to and including 1.4.2 . The vulnerability is rated CVSS 3.1 7.6 (HIGH) with a vector of AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/...

CVE-2026-92465 WordPress WP Mega Menu plugin <= 1.4.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Themeum WP Mega Menu allows Blind SQL Injection. This issue affects WP Mega Menu: from n/a through 1.4.2...

WordPress WP Mega Menu plugin <= 1.4.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Mega Menu versions = 1.4.2...

CVE-2026-8462

SQL injection in ClickHouse-backed meter definitions in OpenMeter OpenMeter before v1.0.0-beta.228 on all platforms allows a remote unauthenticated attacker to access or modify metering event data, and potentially cause denial of service, via crafted user-controlled JSONPath values submitted to...

CVE-2026-8462 OpenMeter SQL Injection in ClickHouse-backed Meter Definitions

SQL injection in ClickHouse-backed meter definitions in OpenMeter OpenMeter before v1.0.0-beta.228 on all platforms allows a remote unauthenticated attacker to access or modify metering event data, and potentially cause denial of service, via crafted user-controlled JSONPath values submitted to...

CVE-2026-8462

SQL injection in ClickHouse-backed meter definitions in OpenMeter OpenMeter before v1.0.0-beta.228 on all platforms allows a remote unauthenticated attacker to access or modify metering event data, and potentially cause denial of service, via crafted user-controlled JSONPath values submitted to...

EUVD-2026-80392

SQL injection in ClickHouse-backed meter definitions in OpenMeter OpenMeter before v1.0.0-beta.228 on all platforms allows a remote unauthenticated attacker to access or modify metering event data, and potentially cause denial of service, via crafted user-controlled JSONPath values submitted to...

CVE-2026-8462 OpenMeter SQL Injection in ClickHouse-backed Meter Definitions

SQL injection in ClickHouse-backed meter definitions in OpenMeter OpenMeter before v1.0.0-beta.228 on all platforms allows a remote unauthenticated attacker to access or modify metering event data, and potentially cause denial of service, via crafted user-controlled JSONPath values submitted to...

CVE-2026-8462 OpenMeter SQL Injection in ClickHouse-backed Meter Definitions

SQL injection in ClickHouse-backed meter definitions in OpenMeter OpenMeter before v1.0.0-beta.228 on all platforms allows a remote unauthenticated attacker to access or modify metering event data, and potentially cause denial of service, via crafted user-controlled JSONPath values submitted to...

CVE-2026-8462

CVE-2026-8462 is a SQL injection in OpenMeter (versions before v1.0.0-beta.228 ) in the ClickHouse-backed meter definitions. The vulnerable code in openmeter/streaming/clickhouse/utils_query.go builds ClickHouse queries using fmt.Sprintf with sqlbuilder.Escape(), which fails to escape single quot...

Important: Red Hat Security Advisory: postgresql:18 security update

An update for the postgresql:18 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse

A SQL injection flaw in PostgreSQL's EXTRACT expression deparser allows an authenticated object owner to execute arbitrary SQL commands with superuser privileges. By defining a hostile database object, an attacker can achieve privilege escalation when deparsing tools like pgdump or psql inspect o...

postgresql: PostgreSQL: SQL injection in pg_createsubscriber allows arbitrary SQL execution as superuser

A flaw was found in PostgreSQL. An attacker with pgcreatesubscription rights can exploit a SQL injection vulnerability in the pgcreatesubscriber utility. This allows the attacker to execute arbitrary SQL commands with superuser privileges when pgcreatesubscriber is next run, leading to potential...