PT-2026-110634

Name of the Vulnerable Software and Affected Versions Exponent CMS versions prior to 3.0.2patch3 Description An issue exists in the XML-RPC component within the userLogin function of the xmlrpc.php file. This flaw allows a remote attacker to perform SQL injection, which is a technique used to...

CVE-2026-108824: Improper Neutralization of Special Elements used in an SQL Command

A flaw has been found in DataEase up to 3.0.0. The impacted element is the function Utils.buildCalcField of the file io/dataease/engine/utils/Utils.java. This manipulation of the argument calculated field causes sql injection. It is possible to initiate the attack remotely. The exploit has been...

PT-2026-110409

Name of the Vulnerable Software and Affected Versions erzhongxmu JEEWMS versions prior to 2026.09.27-W39 Description A SQL injection flaw exists in the Autocomplete Handler component. A remote attacker can exploit this by manipulating the trem, searchField, or entityName arguments within the...

CVE-2026-108782: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected by this issue is the function CommonServiceImpl.getAutoList of the file src/main/java/org/jeecgframework/core/common/service/impl/CommonServiceImpl.java of the component Autocomplete Handler. Executing a manipulati...

CVE-2026-109647: Improper Neutralization of Special Elements used in an SQL Command

Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in multiple endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information...

PT-2026-110770

Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 26.9.0 Description An SQL injection issue exists where unprivileged users can execute arbitrary SQL commands. This is achieved by providing an array-valued notification id parameter to the 'notifications.inc.php'...

PT-2026-110909

Name of the Vulnerable Software and Affected Versions itsourcecode Baptism Information Management System version 1.0 Description A SQL injection flaw exists in the pbaptism.php file. This issue occurs when the b id argument is manipulated, allowing a remote attacker to execute arbitrary SQL...

PT-2026-111061

Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers can send specially crafted requests to inject SQL into database queries and extract sensitive information from the underlying...

PT-2026-111052

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.102.0 Frappe ERPNext versions 16.x prior to 16.8.0 Description Missing input validation in certain endpoints allows authenticated attackers with low privileges to perform SQL injection, which is a technique...

PT-2026-111012

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.9 Description An SQL injection issue exists in the PdoMysql::escape function. When MySQL or MariaDB is configured in NO BACKSLASH ESCAPES mode, single quotes are escaped with backslashes that the database treats ...

PT-2026-111087

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.98.0 Frappe ERPNext versions 16.x prior to 16.6.0 Description Missing input validation in certain endpoints allows remote authenticated attackers to perform SQL injection. By sending specially crafted...

PT-2026-110899

Name of the Vulnerable Software and Affected Versions itsourcecode Baptism Information Management System version 1.0 Description A remote SQL injection flaw exists in the ebaptism.php file. This issue occurs when the ID argument is manipulated, allowing an attacker to execute arbitrary SQL comman...

CVE-2026-108813: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in SEMCMS up to 5.0. This affects an unknown function of the file SEMCMSDownload.php. Performing a manipulation results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about th...

CVE-2026-109638: Improper Neutralization of Special Elements used in an SQL Command

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information from...

CVE-2026-108807: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. This affects the function mysqlquery of the file source/adminregister.php of the component Registration Handler. Performing a manipulation results in sql injection. The attack may be...

VulnCheck KEV: CVE-2026-0702

The VidShop – Shoppable Videos for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'fields' parameter in all versions up to, and including, 1.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

TencentOS Server 3: php:7.4 (TSSA-2026:1150)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1150 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

EulerOS 2.0 SP11 : apr-util (EulerOS-SA-2026-4211)

According to the versions of the apr-util packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility:...

AlmaLinux 9.2 [TuxCare] Security Update: mariadb-connector-c / mariadb-connector-c-config / etc (ALMALINUX9.2:CLSA-2026:1791795699)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791795699 advisory. - MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated us...

EulerOS 2.0 SP13 : apr-util (EulerOS-SA-2026-4120)

According to the versions of the apr-util packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons,...