EUVD-2026-78207

GrowthBook through 5.0.1 returns unredacted fact table definitions including raw warehouse SQL in payloads served by unauthenticated public report and experiment endpoints. Attackers with knowledge of a publicly shared report or experiment identifier can read internal data warehouse query text,...

CVE-2026-90841

A security flaw has been discovered in PHPGurukul Blood Donor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /application/controllers/admin/Report.php of the component Report Endpoint. The manipulation of the argument fromdate/todate results in sql...

CVE-2026-90844 PHPGurukul Daily Expense Tracker System Login index.php sql injection

A vulnerability was detected in PHPGurukul Daily Expense Tracker System 1.1. This vulnerability affects unknown code of the file /dets/index.php of the component Login. Performing a manipulation of the argument email results in sql injection. Remote exploitation of the attack is possible. The...

CVE-2026-90844 PHPGurukul Daily Expense Tracker System Login index.php sql injection

A vulnerability was detected in PHPGurukul Daily Expense Tracker System 1.1. This vulnerability affects unknown code of the file /dets/index.php of the component Login. Performing a manipulation of the argument email results in sql injection. Remote exploitation of the attack is possible. The...

CVE-2026-90844

PHPGurukul Daily Expense Tracker System 1.1 is affected by a SQL injection vulnerability in the Login component, specifically in the file /dets/index.php. The flaw is triggered by manipulating the email argument, allowing remote unauthenticated exploitation over the network. The CVSS v3.1 base sc...

EUVD-2026-78230

A vulnerability was detected in PHPGurukul Daily Expense Tracker System 1.1. This vulnerability affects unknown code of the file /dets/index.php of the component Login. Performing a manipulation of the argument email results in sql injection. Remote exploitation of the attack is possible. The...

PT-2026-92402

Concrete CMS 9 before 9.5.3 did not escape SQL LIKE wildcard characters in the keyword search filters used by the file manager, file folders, and page list, allowing an authenticated user with editor-level or higher privileges to submit a crafted search containing many single-character wildcards...

PT-2026-91866

Name of the Vulnerable Software and Affected Versions WP Directory Kit WordPress plugin versions prior to 1.5.8 Description Authenticated users with Editor privileges or higher can perform SQL injection attacks. The issue occurs because certain widget settings are not properly sanitized or escape...

CVE-2026-79303

kaiten from 57.192.20 to before 57.214.26 is vulnerable to SQL Injection. Dynamic SQL statements are generated without the required data validation and without using parameterized statements or stored procedures...

CVE-2026-92237: Insertion of Sensitive Information into Log File

Insertion of sensitive information into log file in the slow query logging feature in Devolutions PowerShell Universal 2026.2.5 and earlier allows an authenticated user with log read permission to obtain application tokens, data protection key material and other stored credentials via SQL paramet...

CVE-2026-87238: Improper Neutralization of Special Elements used in an SQL Command

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion component: Security. The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Hyperion Financial...

CVE-2026-87212: Improper Neutralization of Special Elements used in an SQL Command

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion component: Security. The supported version that is affected is 11.2.26.0.000. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SQL to compromise Oracle Hyperion Financial...

CVE-2026-87207: Improper Neutralization of Special Elements used in an SQL Command

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion component: Security. The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows high privileged attacker with network access via SQL to compromise Oracle Hyperion Financial...

CVE-2026-87202: Improper Neutralization of Special Elements used in an SQL Command

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion component: Security. The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Hyperion Financial...

CVE-2026-87184: Improper Neutralization of Special Elements used in an SQL Command

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion component: Security. The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via SQL to compromise Oracle Hyperion Financial...

CVE-2026-87178: Improper Access Control

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion component: Security. The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows high privileged attacker with network access via SQL to compromise Oracle Hyperion Financial...

CVE-2026-83210: Improper Neutralization of Special Elements used in an SQL Command

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM component: Server Infrastructure. Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Siebel CRM Deployment. Successful...

CVE-2026-83208: Improper Neutralization of Special Elements used in an SQL Command

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM component: Migration. Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Siebel CRM Deployment. Successful attacks of...

CVE-2026-83182: Improper Access Control

Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM component: Configuration Tools. Supported versions that are affected are 17.0-26.7. Difficult to exploit vulnerability allows low privileged attacker with network access via SQL to compromise Siebel CRM Development. Successf...

CVE-2026-81567: Improper Neutralization of Special Elements used in an SQL Command

Joomla Extension - j2commerce.com - Unauthenticated blind SQL injection in the storefront product list in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Unauthenticated, blind extraction of arbitrary database content e.g. customer records, order data, stored credentials/tokens via boolean- or...