287232 matches found
WordPress ELEX WooCommerce Request a Quote plugin < 2.4.1 - Unauthenticated SQLi vulnerability
Unauthenticated SQLi vulnerability discovered by Artus KG in WordPress Plugin ELEX WooCommerce Request a Quote versions 2.4.1...
CLEANSTART-2026-MQ51708 sqlparse is a non-validating SQL parser module for Python
Multiple security vulnerabilities affect the apache-superset package. sqlparse is a non-validating SQL parser module for Python. See references for individual vulnerability details...
EUVD-2026-75219
A vulnerability was detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This vulnerability affects the function storeCustomerOrderInvoice of the file includes/manage.php. Performing a manipulation of the argument proname results in sql injection. The...
EUVD-2026-75182
A vulnerability was identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected is the function updaterecord of the file includes/manage.php. The manipulation of the argument updatecategory/cid/updatebrand/updateproduct leads to sql injection. The...
CVE-2026-87925
A vulnerability was detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This vulnerability affects the function storeCustomerOrderInvoice of the file includes/manage.php. Performing a manipulation of the argument proname results in sql injection. The...
CVE-2026-73698: Improper Neutralization of Special Elements used in an SQL Command
FileRun before 2026.3.0 contains a SQL injection vulnerability that allows delegated or simple administrators to execute arbitrary SQL by submitting the description parameter as an array, causing the getValuesString method in DB/DP.php to interpolate raw array values directly into an INSERT...
CVE-2026-81800: Improper Neutralization of Special Elements used in an SQL Command
Unauthenticated SQL Injection in Verified Reviews Avis Vérifiés = 2.4.6 versions...
CVE-2026-78082: Improper Neutralization of Special Elements used in an SQL Command
Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property 4.1.4 - The property search and listing query builders assembled several WHERE and ORDER BY clauses zipcode, sorting, pricerangedropdown, and psizerangedropdown by directly...
CVE-2026-7188: Improper Neutralization of Special Elements used in an SQL Command
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Armiya Information Technologies Ltd. Co. Access Control System allows SQL Injection. This issue affects Access Control System: before Versiyon 2...
PT-2026-89348
Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property 4.1.4 - The property search and listing query builders assembled several WHERE and ORDER BY clauses zipcode, sorting, price range dropdown, and psize range dropdown by directly...
CVE-2026-38626
Garlic-Hub v1.0.1 is vulnerable to SQL Injection due to the improper neutralization of special elements used in an SQL command. The flaw is located within the src/Modules/Items/Repositories/ItemsRepository.php file. This vulnerability allows for unauthorized access to or manipulation of the under...
PT-2026-89498
FileRun before 2026.3.0 contains a SQL injection vulnerability that allows delegated or simple administrators to execute arbitrary SQL by submitting the description parameter as an array, causing the getValuesString method in DB/DP.php to interpolate raw array values directly into an INSERT...
CVE-2026-38626
Garlic-Hub v1.0.1 is vulnerable to SQL Injection in src/Modules/Items/Repositories/ItemsRepository.php...
CVE-2026-9163: Improper Neutralization of Special Elements used in an SQL Command
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in GIS Informatics GisLab Laboratory Management System allows SQL Injection. This issue affects GisLab Laboratory Management System: from 1.4.03 before 1.5...
VulnCheck KEV: CVE-2026-18884
The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection via 'orderby' and 'order' GET Parameters in all versions up to, and including, 2.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Thi...
VulnCheck KEV: CVE-2026-42031
CKAN is an open-source DMS data management system for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, a vulnerability in datastoresearchsql allowed attackers to inject SQL in order to gain access to private resources and PostgreSQL system information This vulnerability is fixed ...
PT-2026-89680
Security Advisory: SQL Injection in Custom Reports via Malicious Report Configuration Summary Impact A SQL injection vulnerability exists in the Custom Reports bundle bundles/CustomReportsBundle/src/Tool/Adapter/Sql.php:84-135. An authenticated attacker with reports config permission can inject...
CVE-2026-87925: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This vulnerability affects the function storeCustomerOrderInvoice of the file includes/manage.php. Performing a manipulation of the argument proname results in sql injection. The...
CVE-2026-88890: Improper Neutralization of Special Elements used in an SQL Command
OpenPanel through 2.3.0 contains an SQL injection vulnerability in the analytics filter builder that fails to validate profile. filter column identifiers before interpolating them into ClickHouse WHERE clauses. An authenticated attacker with project-scoped read or root export credentials can inje...