285078 matches found
PT-2026-89401
šØ CVE-2026-88890 OpenPanel through commit cd24bb8 contains an SQL injection vulnerability in the analytics filter builder that fails to validate profile. filter column identifiers before interpolating them into ClickHouse WHERE clauses. An authenticated attacker with project-scoped read or root...
CVE-2026-38626
Garlic-Hub v1.0.1 is vulnerable to SQL Injection in src/Modules/Items/Repositories/ItemsRepository.php...
CVE-2026-38626: Improper Neutralization of Special Elements used in an SQL Command
Garlic-Hub v1.0.1 is vulnerable to SQL Injection in src/Modules/Items/Repositories/ItemsRepository.php...
PT-2026-89748
Name of the Vulnerable Software and Affected Versions Sticky Chat Widget versions prior to 1.4.3 Description Unauthenticated attackers can perform SQL Injection through the scw form fields parameter array keys within the scw save form data AJAX action. The issue occurs because the save form data...
CVE-2026-38626
Garlic-Hub v1.0.1 is vulnerable to SQL Injection in src/Modules/Items/Repositories/ItemsRepository.php...
PT-2026-89680
Security Advisory: SQL Injection in Custom Reports via Malicious Report Configuration Summary Impact A SQL injection vulnerability exists in the Custom Reports bundle bundles/CustomReportsBundle/src/Tool/Adapter/Sql.php:84-135. An authenticated attacker with reports config permission can inject...
CVE-2026-88890: Improper Neutralization of Special Elements used in an SQL Command
OpenPanel through 2.3.0 contains an SQL injection vulnerability in the analytics filter builder that fails to validate profile. filter column identifiers before interpolating them into ClickHouse WHERE clauses. An authenticated attacker with project-scoped read or root export credentials can inje...
PT-2026-89300
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Armiya Information Technologies Ltd. Co. Access Control System allows SQL Injection. This issue affects Access Control System: before Versiyon 2...
PT-2026-89588
A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user ROLE USER can run the shipped, default-enabled online reports "Maintenance contracts expired" AssetManagementMaintExpired and...
PT-2026-89368
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in GIS Informatics GisLab Laboratory Management System allows SQL Injection. This issue affects GisLab Laboratory Management System: from 1.4.03 before 1.5...
VulnCheck KEV: CVE-2022-1057
The Pricing Deals for WooCommerce WordPress plugin through 2.0.2.02 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection...
VulnCheck KEV: CVE-2024-36412
SuiteCRM is an open-source Customer Relationship Management CRM software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in events response entry point allows for a SQL injection attack. Versions 7.14.4 and 8.6.1 contain a fix for this issue...
VulnCheck KEV: CVE-2026-42031
CKAN is an open-source DMS data management system for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, a vulnerability in datastoresearchsql allowed attackers to inject SQL in order to gain access to private resources and PostgreSQL system information This vulnerability is fixed ...
VulnCheck KEV: CVE-2026-18884
The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection via 'orderby' and 'order' GET Parameters in all versions up to, and including, 2.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Thi...
CVE-2026-73698: Improper Neutralization of Special Elements used in an SQL Command
FileRun before 2026.3.0 contains a SQL injection vulnerability that allows delegated or simple administrators to execute arbitrary SQL by submitting the description parameter as an array, causing the getValuesString method in DB/DP.php to interpolate raw array values directly into an INSERT...
CVE-2026-7188: Improper Neutralization of Special Elements used in an SQL Command
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Armiya Information Technologies Ltd. Co. Access Control System allows SQL Injection. This issue affects Access Control System: before Versiyon 2...
CVE-2026-87925 Rizwan17 inventory-management-system manage.php storeCustomerOrderInvoice sql injection
A vulnerability was detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This vulnerability affects the function storeCustomerOrderInvoice of the file includes/manage.php. Performing a manipulation of the argument proname results in sql injection. The...
CVE-2026-87925 Rizwan17 inventory-management-system manage.php storeCustomerOrderInvoice sql injection
A vulnerability was detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This vulnerability affects the function storeCustomerOrderInvoice of the file includes/manage.php. Performing a manipulation of the argument proname results in sql injection. The...
CVE-2026-87925
A SQL injection vulnerability in Rizwan17 inventory-management-system (up to commit bfe78a3) affects the storeCustomerOrderInvoice function in includes/manage.php. Manipulating the pro_name[] argument allows a remote, unauthenticated attacker to inject SQL, leading to partial compromise of confid...
CVE-2026-87925 Rizwan17 inventory-management-system manage.php storeCustomerOrderInvoice sql injection
A vulnerability was detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This vulnerability affects the function storeCustomerOrderInvoice of the file includes/manage.php. Performing a manipulation of the argument proname results in sql injection. The...