CVE-2026-122048

A vulnerability was identified in Campcodes Division Regional Athletic Meet Game Result Matrix System up to 2.1. This affects an unknown function of the file /dipam/check-user.php. Such manipulation of the argument abbr leads to sql injection. It is possible to launch the attack remotely. The...

CVE-2026-122048

A vulnerability exists in the Campcodes Division Regional Athletic Meet Game Result Matrix System (up to version 2.1 ). The flaw is located in an unknown function within the /dipam/check-user.php file. Attackers can perform a remote SQL injection by manipulating the abbr argument. An exploit is p...

CVE-2026-122048 Campcodes Division Regional Athletic Meet Game Result Matrix System check-user.php sql injection

A vulnerability was identified in Campcodes Division Regional Athletic Meet Game Result Matrix System up to 2.1. This affects an unknown function of the file /dipam/check-user.php. Such manipulation of the argument abbr leads to sql injection. It is possible to launch the attack remotely. The...

CVE-2026-122038

The krupalshah EmployeeRecruitmentSystem is vulnerable to a remote SQL injection via the mysql_query function in the source/reqformprocessing.php file within the Requirement Board Update Handler component. The vulnerability affects products up to commit 922ff6d208278282e7c8e36d70d9ae356adec9fe. E...

CVE-2026-47678

The GLPI asset and IT management software package contains a blind time-based SQL injection vulnerability in its dropdown values fetching endpoint. Affected versions range from 9.4.0 up to, but not including, 10.0.26 and 11.0.8 . An authenticated user can submit crafted values that are improperly...

CVE-2026-47678 GLPI: Blind Time based SQLI in dropdowns

GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, any authenticated user can submit crafted values to the dropdown values fetching endpoint that are incorporated into a database query. This permits SQL injection through the dropdown endpoint. This issue...

CVE-2024-51482-POC

ZoneMinder Authenticated Time Based SQLi POC - CVE-2024-51482 ⚠️ For educational and authorized security research only. Running this tool against systems you do not own or lack written permission to test is illegal. Table of Contents ZoneMinder Authenticated Time Based SQLi POC - CVE-2024-51482...

CVE-2025-71456

vtenext before 25.02.2 contains an SQL injection vulnerability that allows authenticated low-privileged users to inject SQL by supplying a crafted fieldname parameter to modules/Fax/EditView.php. Attackers can read arbitrary database contents, including password reset tokens stored in...

CVE-2025-71456 vtenext before 25.02.2 SQL Injection via fieldname in Fax EditView

vtenext before 25.02.2 contains an SQL injection vulnerability that allows authenticated low-privileged users to inject SQL by supplying a crafted fieldname parameter to modules/Fax/EditView.php. Attackers can read arbitrary database contents, including password reset tokens stored in...

CVE-2025-71456

The vtenext software (versions before 25.02.2 ) is vulnerable to an SQL injection flaw located in the modules/Fax/EditView.php component. This vulnerability exists because the application fails to properly neutralize the fieldname parameter. Authenticated users with low privileges can exploit thi...

EUVD-2025-211254

vtenext before 25.02.2 contains an SQL injection vulnerability that allows authenticated low-privileged users to inject SQL by supplying a crafted fieldname parameter to modules/Fax/EditView.php. Attackers can read arbitrary database contents, including password reset tokens stored in...

CVE-2026-113370

Sonatype Nexus Repository 3 contains a SQL injection vulnerability in the optional "Reindex Search Tables By Pattern" task. A user who holds the nexus:tasks:create privilege can supply a crafted filter condition that the database runs as SQL. This allows the user to modify data in the Nexus...

CVE-2026-113370

Sonatype Nexus Repository 3 contains a SQL injection vulnerability (CWE-89) within the optional **

EUVD-2026-117061

Sonatype Nexus Repository 3 contains a SQL injection vulnerability in the optional "Reindex Search Tables By Pattern" task. A user who holds the nexus:tasks:create privilege can supply a crafted filter condition that the database runs as SQL. This allows the user to modify data in the Nexus...

DEBIAN-CVE-2026-122032

SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access to inject arbitrary SQL by submitting a differing where parameter value in the POST body versus the GET query string on the /ecrire/?exec=articles endpoint, bypassing...

CVE-2026-122032

SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access to inject arbitrary SQL by submitting a differing where parameter value in the POST body versus the GET query string on the /ecrire/?exec=articles endpoint, bypassing...

CVE-2026-121009

A flaw was found in SQL::Abstract. The library fails to enforce its injection validation guard when function names are specified using the explicit -func argument, placing the input directly into database queries without verification. A remote attacker who can control function name inputs in an...

CVE-2026-121007

A flaw was found in SQL::Abstract. When processing nested statements placed in identifier positions, the library inserts clause values directly into raw database queries rather than parameterizing them as bound values. If an application incorporates untrusted input into these nested queries, an...

CVE-2026-121009

SQL::Abstract versions from 1.9001 before 2.00000104 for Perl skip the injectionguard check for function names given with -func. injectionguard is documented to apply to every function name, but only the -name = ... shorthand goes through it. The explicit -func = $name, ... form puts $name into t...

CVE-2026-121007

SQL::Abstract versions from 1.9001 before 2.00000104 for Perl allow SQL injection via the where values of a nested statement in an identifier position. A nested statement such as -select = ... in a position where plain scalars are identifiers treats its own plain scalars as identifiers too. These...