CVE-2026-81815

SQL Injection in the entity engine's generic performFind service in Apache OFBiz 24.09 before 24.09.08 on MySQL/MariaDB-backed deployments allows a remote unauthenticated attacker to disclose arbitrary rows from the queried entity by submitting an ignore-case find request e.g. ic=Y with a crafted...

CVE-2026-115738

SQL injection vulnerability in DLP on-prem extensions version 11.13.1 and earlier allows a remote authenticated attacker to inject SQL queries without sanitization or parameterized queries...

EUVD-2026-117530

SQL injection vulnerability in DLP on-prem extensions version 11.13.1 and earlier allows a remote authenticated attacker to inject SQL queries without sanitization or parameterized queries...

CVE-2026-115738

SQL injection vulnerability in DLP on-prem extensions version 11.13.1 and earlier allows a remote authenticated attacker to inject SQL queries without sanitization or parameterized queries...

CVE-2026-115738

A SQL injection vulnerability exists in DLP on-prem extensions version 11.13.1 and earlier . The flaw allows a remote authenticated attacker to inject SQL queries because the application fails to use sanitization or parameterized queries . The vulnerability is associated with CWE-89 and carries a...

CVE-2026-123028

A vulnerability was identified in itsourcecode Online Book Store 1.0. Affected by this issue is some unknown functionality of the file /adminedit.php. The manipulation of the argument bookisbn with the input...

CVE-2026-105321

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Kobikom Telecommunications and Informatics Services Inc. Kobikom allows SQL Injection. This issue affects Kobikom: before KobiPBX-FOP3-SEC-r1...

CVE-2026-81815

Apache OFBiz versions 24.09 before 24.09.08 are vulnerable to SQL injection in the entity engine's generic performFind service when using MySQL/MariaDB backends. The root cause is that SqlJdbcUtil.addValueSingle inlines values directly into the SQL text using ANSI-only single-quote doubling inste...

EUVD-2026-117483

SQL Injection in the entity engine's generic performFind service in Apache OFBiz 24.09 before 24.09.08 on MySQL/MariaDB-backed deployments allows a remote unauthenticated attacker to disclose arbitrary rows from the queried entity by submitting an ignore-case find request e.g. ic=Y with a crafted...

CVE-2026-123028 itsourcecode Online Book Store admin_edit.php sql injection

A vulnerability was identified in itsourcecode Online Book Store 1.0. Affected by this issue is some unknown functionality of the file /adminedit.php. The manipulation of the argument bookisbn with the input...

EUVD-2026-117471

A vulnerability was identified in itsourcecode Online Book Store 1.0. Affected by this issue is some unknown functionality of the file /adminedit.php. The manipulation of the argument bookisbn leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly availabl...

CVE-2026-123028

A SQL injection vulnerability exists in the itsourcecode Online Book Store 1.0 application. The flaw is located within an unknown functionality of the /admin_edit.php file, where the manipulation of the bookisbn argument allows for remote attack initiation. The documents indicate that an exploit ...

EUVD-2026-117438

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Kobikom Telecommunications and Informatics Services Inc. Kobikom allows SQL Injection. This issue affects Kobikom: before KobiPBX-FOP3-SEC-r1...

CVE-2026-105321 SQL Injection in Kobikom Telecommunications' Kobikom

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Kobikom Telecommunications and Informatics Services Inc. Kobikom allows SQL Injection. This issue affects Kobikom: before KobiPBX-FOP3-SEC-r1...

CVE-2026-105321

The software Kobikom by Kobikom Telecommunications and Informatics Services Inc. is vulnerable to an SQL injection (CWE-89) due to improper neutralization of special elements in SQL commands. This vulnerability affects versions before KobiPBX-FOP3-SEC-r1 . The security impact is rated as High wit...

CVE-2025-64459-Poc

CVE-2025-64459: Django ORM SQL Injection PoC Vulnerability: SQL Injection via QuerySet and Q keyword argument unpacking. CVE ID: CVE-2025-64459 Discovered By: Me Cyberstan Disclosure Date: November 5, 2025 🚨 Executive Summary This repository contains a Dockerized Proof of Concept PoC demonstratin...

blind-sql-bitshifting

Blind SQL Injection via Bitshifting This is a module that performs blind SQL injection by using the bitshifting method to calculate characters instead of guessing them. It requires 7/8 requests per character, depending on the configuration. Usage import blind-sql-bitshifting as x Edit this...

TarantuBench

TarantuBench v1 A benchmark for evaluating AI agents on web security challenges, generated by the TarantuLabs engine. What is this? TarantuBench is a collection of 100 vulnerable web applications, each containing a hidden flag TARANTU.... An agent's job is to find and extract the flag by...

CVE-2026-107786

The CatFolders WordPress plugin before 2.5.7 does not properly sanitize and escape a user-controlled sort setting before using it in a SQL query, allowing authenticated users with upload capability Author and above to perform SQL injection attacks...

CVE-2026-100144

The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenticated attackers to read arbitrary data from the database...