PT-2026-136979

SQL::Abstract versions from 1.90 01 before 2.000001 04 for Perl allow SQL injection via the where values of a nested statement in an identifier position. A nested statement such as -select = ... in a position where plain scalars are identifiers treats its own plain scalars as identifiers too. The...

PT-2026-136996

SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access to inject arbitrary SQL by submitting a differing where parameter value in the POST body versus the GET query string on the /ecrire/?exec=articles endpoint, bypassing spip sanitiz...

PT-2026-137228

Name of the Vulnerable Software and Affected Versions krupalshah EmployeeRecruitmentSystem affected versions not specified Description A remote SQL injection issue exists within the Requirement Board Update Handler component. The flaw is located in the mysql query function within the...

Linux Distros Unpatched Vulnerability : CVE-2026-119419

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated collation values to StringExpression...

UBUNTU-CVE-2026-122032

SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access to inject arbitrary SQL by submitting a differing where parameter value in the POST body versus the GET query string on the /ecrire/?exec=articles endpoint, bypassing...

CVE-2026-122032: SPIP: SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access…

SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access to inject arbitrary SQL by submitting a differing where parameter value in the POST body versus the GET query string on the /ecrire/?exec=articles endpoint, bypassing...

PT-2026-137237

A vulnerability was identified in Campcodes Division Regional Athletic Meet Game Result Matrix System up to 2.1. This affects an unknown function of the file /dipam/check-user.php. Such manipulation of the argument abbr leads to sql injection. It is possible to launch the attack remotely. The...

CVE-2026-121731

RosarioSIS before 12.9 contains a sql injection vulnerability that allows authenticated non-student users, including parents, to inject SQL via the unquoted periodid parameter in StudentSummary.php. Attackers can supply payloads without single quotes into IN clauses to extract administrator...

CVE-2026-121731 RosarioSIS before 12.9 SQL Injection via period_id in Attendance Absence Report

RosarioSIS before 12.9 contains a sql injection vulnerability that allows authenticated non-student users, including parents, to inject SQL via the unquoted periodid parameter in StudentSummary.php. Attackers can supply payloads without single quotes into IN clauses to extract administrator...

CVE-2026-121731

RosarioSIS versions prior to 12.9 are vulnerable to a SQL injection flaw within the StudentSummary.php component. The root cause is the use of an unquoted period_id parameter, which allows authenticated non-student users, such as parents, to inject payloads into IN() clauses. This vulnerability c...

CVE-2026-121524

A flaw has been found in sumiie24 School-Management-System up to d946d649c7c95e101fc5679ecd91999533bb10d7. Affected by this issue is some unknown functionality of the file parentLogin.php of the component Public Search Feature. Executing a manipulation of the argument email can lead to sql...

CVE-2026-121524

The sumiie24 School-Management-System is vulnerable to a remote SQL injection flaw within the Public Search Feature component, specifically affecting the parent_Login.php file (up to commit d946d649c7c95e101fc5679ecd91999533bb10d7). An attacker can manipulate the email argument to execute arbitra...

CVE-2026-121524 sumiie24 School-Management-System Public Search Feature parent_Login.php sql injection

A flaw has been found in sumiie24 School-Management-System up to d946d649c7c95e101fc5679ecd91999533bb10d7. Affected by this issue is some unknown functionality of the file parentLogin.php of the component Public Search Feature. Executing a manipulation of the argument email can lead to sql...

CVE-2026-121502

A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project. The impacted element is an unknown function of the file facultydetails.php. The manipulation of the argument deleteid leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and migh...

CVE-2026-95748

A SQL injection vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to run arbitrary database commands...

CVE-2026-45146

Chamilo LMS is an open-source learning management system. Prior to 1.11.40 and 2.0.1, an authenticated administrator can call the getsessions action in /main/inc/ajax/model.ajax.php with search=true and a crafted JSON filters parameter whose groupOp field contains SQL syntax. Because groupOp is n...

EUVD-2026-116212

A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project. The impacted element is an unknown function of the file facultydetails.php. The manipulation of the argument deleteid leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and migh...

CVE-2026-121502

A SQL injection vulnerability exists in the mathurvishal CloudClassroom-PHP-Project within an unknown function of the facultydetails.php file. The vulnerability is triggered by manipulating the deleteid argument, allowing for remote execution of unauthorized SQL commands. The product follows a ro...

CVE-2026-45146 Chamilo LMS: Blind SQL Injection in model.ajax.php via filters[groupOp] authentificated

Chamilo LMS is an open-source learning management system. Prior to 1.11.40 and 2.0.1, an authenticated administrator can call the getsessions action in /main/inc/ajax/model.ajax.php with search=true and a crafted JSON filters parameter whose groupOp field contains SQL syntax. Because groupOp is n...

CVE-2026-45146

An authenticated administrator can exploit a SQL injection vulnerability in Chamilo LMS prior to versions 1.11.40 and 2.0.1 . The issue exists in the get_sessions action within /main/inc/ajax/model.ajax.php when _search=true is used. Because the groupOp field in the JSON filters parameter is not ...