CVE-2026-96428 Flowring Agentflow 4.0 - SQL Injection

SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the words parameter...

EUVD-2026-88655

SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the words parameter...

WordPress Books Gallery plugin <= 4.8.3 - SQL Injection vulnerability

SQL Injection vulnerability discovered by sungbyeongchan in WordPress Plugin Books Gallery versions = 4.8.3...

sitesentinel

SiteSentinel A drop-in website security module that partici...

Exploit for CVE-2026-101110

CVE-2026-101110 — OrdaSoft Book Library Free unauthenticated...

EUVD-2026-88559

SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyuan.db. Attackers can craft malicious .sy documents with non-read-only SQL statements that execute automatically during background indexing, rendering, or export operations witho...

Exploit for CVE-2026-101108

CVE-2026-101108 — OrdaSoft Vehicle Manager Free unauthentica...

Exploit for CVE-2026-100752

CVE-2026-100752 — OrdaSoft Real Estate Manager Free unauthen...

CVE-2026-79536

bytebase dbhub v1.2.0 was discovered to contain a SQL injection vulnerability in the /utils/sql-parser.ts component. This vulnerability allows attackers to access sensitive databse information via a crafted SQL statement...

EUVD-2026-89363

bytebase dbhub v1.2.0 was discovered to contain a SQL injection vulnerability in the /utils/sql-parser.ts component. This vulnerability allows attackers to access sensitive databse information via a crafted SQL statement...

CVE-2026-79536

bytebase dbhub v1.2.0 was discovered to contain a SQL injection vulnerability in the /utils/sql-parser.ts component. This vulnerability allows attackers to access sensitive databse information via a crafted SQL statement...

CVE-2026-102616: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in risesoft-y9 WorkFlow-Engine up to 9.6.10. Impacted is the function getByIdAndYear of the file CustomHistoricProcessServiceImpl.java of the component OAuth2 Resource Filter. Performing a manipulation of the argument year/processInstanceId results in sql injection...

PT-2026-102909

The "supplier no" parameter used in the business allocation search feature is vulnerable to time-based blind SQL injection...

PT-2026-102631

Seeyon A6 collaborative office automation platform contains an unauthenticated SQL injection vulnerability in the attach ids parameter of the file attachment download endpoint that allows remote attackers to extract arbitrary database contents without prior authentication. Attackers can inject...

CVE-2026-72510: Improper Neutralization of Special Elements used in an SQL Command

The "supplierno" parameter used in the business allocation search feature is vulnerable to time-based blind SQL injection...

CVE-2026-102569: Improper Neutralization of Special Elements used in an SQL Command

ClipBucket v5 through 5.5.3-197 contains a time-based blind SQL injection vulnerability in the admin video edit function where the videoid parameter is concatenated into an UPDATE statement without proper escaping. An authenticated administrator with videomoderation permission can inject arbitrar...

CVE-2026-102570: Improper Neutralization of Special Elements used in an SQL Command

ClipBucket v5 through 5.5.3-197 contains a time-based blind SQL injection vulnerability in the language update function where the languageid parameter is concatenated unescaped into the WHERE clause of an UPDATE statement. An authenticated administrator with basicsettings permission can inject...

CVE-2026-96428: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the words parameter...

PT-2026-102819

Name of the Vulnerable Software and Affected Versions bytebase dbhub version 1.2.0 Description An issue exists in the /utils/sql-parser.ts component that allows attackers to access sensitive database information by using a crafted SQL statement. This is a SQL injection, which occurs when an...

CVE-2026-63713: Improper Neutralization of Special Elements used in an SQL Command

The "search" parameter in the view audit logs feature within the utilities section is susceptible to a time-based blind SQL injection vulnerability...