VulnCheck KEV: CVE-2022-30047

Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability in /mdiy/dict/listExcludeApp URI via orderBy parameter...

VulnCheck KEV: CVE-2022-27927

A SQL injection vulnerability exists in Microfinance Management System 1.0 when MySQL is being used as the application database. An attacker can issue SQL commands to the MySQL database through the vulnerable coursecode and/or customernumber parameter...

CVE-2026-54529: Improper Input Validation

SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to 0.27.1, ModelView.sortquery in sqladmin/models.py accepts the attacker-controlled sortBy list-view query parameter without enforcing the configured columnsortablelist server-side allow-list in self.sortfields. The value is...

Cisco Secure Email Gateway S/MIME SQL Injection RCE

This module exploits an unauthenticated SQL injection in Cisco Secure Email Gateway S/MIME certificate harvesting. A sender-controlled email address in a signing certificate is used in a PostgreSQL query without escaping. The module sends one signed email whose certificate supplies enough address...

RHEL 10 : postgresql18 (RHSA-2026:67280)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67280 advisory. PostgreSQL is an advanced Object-Relational database management system DBMS. The base postgresql package contains the client programs that...

PT-2026-91196

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized entityKey and opEvent parameters. This issue affects...

CVE-2026-46696: Improper Privilege Management

October System provides the system module for October Content Management System. Versions prior to 3.7.17 and 4.2.21 have a vulnerability in the Twig sandbox security policy that allowed a chained bypass when cms.safemode is enabled. The Laravel session store was exposed to Twig with unrestricted...

CVE-2026-90708: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in Yot CMS up to 3.3.1. Affected by this vulnerability is the function Login of the file global.php of the component Cookie Handler. This manipulation of the argument yot3user/yot3pass causes sql injection. It is possible to initiate the attack remotely. The exploit...

CVE-2026-82028: Improper Neutralization of Special Elements used in an SQL Command

Magistrala before 1.0.0 contains a SQL injection vulnerability in the timescale-reader and postgres-reader HTTP API services that allows authenticated attackers to inject arbitrary SQL by supplying a malicious format query parameter that is interpolated directly into the FROM clause without...

PT-2026-91164

Joomla Extension - joomshaper.com - Authenticated Privileged SQL Injection in the Content Plugin of SP Page Builder Free and Pro 5.2.1 - 6.9.0 - plgContentSppagebuilder::onContentAfterSave read jformattribssppagebuilder article id from the request and concatenated it directly into the WHERE view ...

PT-2026-91443

Magistrala before 1.0.0 contains a SQL injection vulnerability in the timescale-reader and postgres-reader HTTP API services that allows authenticated attackers to inject arbitrary SQL by supplying a malicious format query parameter that is interpolated directly into the FROM clause without...

PT-2026-91286

Name of the Vulnerable Software and Affected Versions subhajitkhan online-clinic-management-system versions up to e9ee77a8827a1446220fa07ee693dc4d9a29a578 Description A remote SQL injection flaw exists in the doctorlogin.php file. This issue occurs when the doc mail and doc pswd arguments are...

SAP NetWeaver SQL Injection Unauthorized Access

The vulnerability of the SAP NetWeaver software integration platform is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

Apache Superset SQL Injection

The vulnerability of the Apache Superset data visualization software lies in the lack of measures taken to protect the SQL query structure during the processing of the parameters sqlExpression and where. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized...

Ivanti Endpoint Manager Code Execution

The vulnerability of the Ivanti Endpoint Manager software control console relates to the lack of security measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2026-90600

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. This impacts an unknown function of the file /pages/invedit1.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may b...

CVE-2026-90597

A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/supedit1.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been...

CVE-2026-90600 itsourcecode Sales and Inventory System inv_edit1.php sql injection

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. This impacts an unknown function of the file /pages/invedit1.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may b...

CVE-2026-90600

itsourcecode Sales and Inventory System 1.0 is vulnerable to SQL injection in the file /pages/inv_edit1.php via manipulation of the ID argument. The attack can be initiated remotely and requires low privileges (authentication). A proof-of-concept exploit has been publicly disclosed and may be use...

CVE-2026-90600 itsourcecode Sales and Inventory System inv_edit1.php sql injection

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. This impacts an unknown function of the file /pages/invedit1.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may b...