CVE-2026-101018: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in dayrui XunruiCMS up to 4.7.2. This issue affects the function groupalledit of the file dayrui/App/Member/Controllers/Admin/Home.php of the component Group Editing. This manipulation of the argument groupid causes sql injection. The attack is possible to be carrie...

CVE-2026-93000: Improper Neutralization of Special Elements used in an SQL Command

The SPS-Suite WordPress plugin through 1.4.0 does not sanitise the search query before using it in a SQL query when its static-page search feature is enabled, allowing unauthenticated attackers to perform SQL injection attacks...

PT-2026-102303

Name of the Vulnerable Software and Affected Versions Matrimonial System version 1.0 Description Remote SQL injection is possible via the Profile Creation Endpoint. The issue occurs in the processprofile form function within the /create profile file when handling the fname variable. SQL injection...

CVE-2026-100894: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This issue affects some unknown processing of the file updateguest.php. The manipulation of the argument gname leads to sql injection. The attack may be initiated remotely. Th...

CVE-2026-101012: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file makeresult.php. This manipulation of the argument makeid causes sql injection. The attack can be initiated remotely. The exploit h...

CVE-2026-100898: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/2.0.0-beta1. This affects the function whereRaw of the file app/Filament/Widgets/Timesheet/ActivitiesReport.php of the component Timesheet Dashboard. Performing a manipulation of the argument filter results in...

CVE-2026-101010: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in aaPanel BaoTa up to 11.8.0. The impacted element is the function getData of the file /www/server/panel/class/data.py. The manipulation of the argument logtype leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly availabl...

PT-2026-99786

Name of the Vulnerable Software and Affected Versions aaPanel BaoTa versions prior to 11.8.1 Description A security flaw in the Domain Handler component allows for remote SQL injection. The issue exists within the get domain status function located in the...

PT-2026-99886

Name of the Vulnerable Software and Affected Versions Dayforce Payroll version R2026.2.0 Description The password recovery functionality is susceptible to Time-Based Blind SQL Injection, a technique where an attacker determines information by observing the time the server takes to respond to...

CVE-2026-89303: Improper Neutralization of Special Elements used in an SQL Command

The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to perform SQL injection attacks...

PT-2026-102301

Name of the Vulnerable Software and Affected Versions Real Estate Manager Free versions prior to 6.7.9 Description An unauthenticated SQL Injection exists in the site/realestatemanager.php endpoint. The issue occurs because the order field parameter is concatenated directly into an unquoted SQL...

PT-2026-99797

Name of the Vulnerable Software and Affected Versions CloudClassroom-PHP-Project affected versions not specified Description A remote SQL injection is possible due to improper handling of the editid argument within an unknown function in the updateresultdetails.php file. SQL injection is a...

PT-2026-99755

Name of the Vulnerable Software and Affected Versions DevaslanPHP project-management versions 1.2.1 through 1.2.4 DevaslanPHP project-management version v2.0.0-beta1 Description A remote SQL injection exists in the Timesheet Dashboard component within the whereRaw function of the...

PT-2026-102304

Name of the Vulnerable Software and Affected Versions Vehicle Manager Free versions prior to 6.5.8 Description An unauthenticated SQL Injection exists in the site/vehiclemanager.php file. The issue occurs because the order field and order direction parameters are processed through a sanitizing...

PT-2026-99787

Name of the Vulnerable Software and Affected Versions CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be Description A remote SQL injection is possible due to improper handling of the makeid argument within an unknown function of the makeresult.php file. SQL...

PT-2026-102306

Name of the Vulnerable Software and Affected Versions Book Library Free versions prior to 6.4.6 Description An unauthenticated SQL Injection exists in the books function within the site/booklibrary.php file. The issue occurs when the function processes the field and direction request parameters...

PT-2026-99836

A vulnerability was determined in dayrui XunruiCMS up to 4.7.2. This issue affects the function group all edit of the file dayrui/App/Member/Controllers/Admin/Home.php of the component Group Editing. This manipulation of the argument groupid causes sql injection. The attack is possible to be...

Harness Blind SQL Injection

Harness open source Gitness suffers from a registry related blind SQL injection vulnerability. https://packetstorm.news/download/233045...

PT-2026-99780

Name of the Vulnerable Software and Affected Versions SPS-Suite WordPress plugin versions prior to 1.4.1 Description An issue exists when the static-page search feature is enabled, where the plugin fails to sanitize the search query before incorporating it into a SQL query. This allows...

CVE-2026-100752: Improper Neutralization of Special Elements used in an SQL Command

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager Free 6.7.9 - site/realestatemanager.php builds the ORDER BY clause of three separate frontend property-listing queries category browsing, search results, and the full property listing from a request-controlled...