PT-2026-92731

Name of the Vulnerable Software and Affected Versions Oracle Siebel CRM versions 17.0 through 26.7 Description A flaw in the Migration component of the Siebel CRM Deployment product allows a low privileged attacker with network access via SQL to compromise the system. Successful exploitation can...

PT-2026-92048

Name of the Vulnerable Software and Affected Versions WuzhiCMS versions prior to 4.1.1 Description A SQL injection issue exists in the article::getDataOfJson function within the '/index.php?m=content&f=article&v=getDataOfJson' endpoint. This occurs when the title/master table argument is...

PT-2026-92054

Flowise versions before 3.1.4 fail to validate file paths in the SQL Database Chain node when connecting to SQLite databases, allowing authenticated attackers to write arbitrary files. Attackers can write malicious SQLite databases to system directories or inject files into the web root to execut...

CVE-2026-91934: Improper Limitation of a Pathname to a Restricted Directory

Flowise versions before 3.1.4 fail to validate file paths in the SQL Database Chain node when connecting to SQLite databases, allowing authenticated attackers to write arbitrary files. Attackers can write malicious SQLite databases to system directories or inject files into the web root to execut...

PT-2026-92417

Name of the Vulnerable Software and Affected Versions Netmaker versions prior to 1.5.0 Description An authenticated attacker can perform boolean-based SQL injection when the SQLite database backend is used. The issue occurs because the sqliteDeleteRecord function in the database layer constructs...

CVE-2026-90854: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in SourceCodester/katojkalemba Online Food Ordering System 1.0. The impacted element is an unknown function of the file /web/category-foods.php. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The...

EUVD-2026-78816

kaiten from 57.192.20 to before 57.214.26 is vulnerable to SQL Injection. Dynamic SQL statements are generated without the required data validation and without using parameterized statements or stored procedures...

PT-2026-91869

A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. The impacted element is an unknown function of the file /delete faculty1.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to t...

School Registration and Fee System SQL Injection Vulnerability

School Registration and Fee System is a school registration and fee management software developed by the SourceCodester community. The School Registration and Fee System has a SQL injection vulnerability, which stems from incorrect handling of the Category parameter in the file bilal/saveclass.ph...

CVE-2026-87238: Improper Neutralization of Special Elements used in an SQL Command

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion component: Security. The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Hyperion Financial...

CVE-2026-79303: Improper Neutralization of Special Elements used in an SQL Command

kaiten from 57.192.20 to before 57.214.26 is vulnerable to SQL Injection. Dynamic SQL statements are generated without the required data validation and without using parameterized statements or stored procedures...

PT-2026-91858

A vulnerability was identified in zyx0814 FilePress up to 3.0.1. This vulnerability affects unknown code of the file dzz/publish/search.php of the component Publish Module. Such manipulation of the argument orderby/order leads to sql injection. The attack can be launched remotely. The exploit is...

CVE-2026-92237: Insertion of Sensitive Information into Log File

Insertion of sensitive information into log file in the slow query logging feature in Devolutions PowerShell Universal 2026.2.5 and earlier allows an authenticated user with log read permission to obtain application tokens, data protection key material and other stored credentials via SQL paramet...

CVE-2026-90849: Improper Neutralization of Special Elements used in an SQL Command

A security vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /College/login.php. The manipulation of the argument User leads to sql injection. The attack may be initiated remotely...

CVE-2024-58385: Improper Neutralization of Special Elements used in an SQL Command

Yonyou U8 CRM contains an unauthenticated SQL injection vulnerability in the fillbacksettingedit.php configuration endpoint where the DontCheckLogin=1 parameter bypasses authentication and the id parameter is incorporated into SQL queries without sanitization. Attackers can exploit this flaw to...

CVE-2026-87178: Improper Access Control

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion component: Security. The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows high privileged attacker with network access via SQL to compromise Oracle Hyperion Financial...

SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37982)

Sales and Inventory System is a sales and inventory management enterprise resource planning system developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability, which stems from incorrect handling of parameters in the file/pages/custpostrans.php. Attackers can explo...

CVE-2026-90879: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in zyx0814 FilePress up to 3.0.1. This vulnerability affects unknown code of the file dzz/publish/search.php of the component Publish Module. Such manipulation of the argument orderby/order leads to sql injection. The attack can be launched remotely. The exploit is...

PT-2026-93035

Name of the Vulnerable Software and Affected Versions Oracle Hyperion Financial Management version 11.2.26.0.000 Description A security flaw in the Security component allows an unauthenticated attacker with network access via SQL to compromise the system. Successful exploitation can lead to...

PT-2026-93025

Name of the Vulnerable Software and Affected Versions Oracle Hyperion Financial Management version 11.2.26.0.000 Description A security flaw in the Security component allows a low privileged attacker with network access via SQL to compromise the system. Successful exploitation can lead to a...