265213 matches found
CVE-2026-95748
A SQL injection vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to run arbitrary database commands...
CVE-2026-45146
Chamilo LMS is an open-source learning management system. Prior to 1.11.40 and 2.0.1, an authenticated administrator can call the getsessions action in /main/inc/ajax/model.ajax.php with search=true and a crafted JSON filters parameter whose groupOp field contains SQL syntax. Because groupOp is n...
EUVD-2026-116212
A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project. The impacted element is an unknown function of the file facultydetails.php. The manipulation of the argument deleteid leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and migh...
CVE-2026-121502
A SQL injection vulnerability exists in the mathurvishal CloudClassroom-PHP-Project within an unknown function of the facultydetails.php file. The vulnerability is triggered by manipulating the deleteid argument, allowing for remote execution of unauthorized SQL commands. The product follows a ro...
CVE-2026-45146 Chamilo LMS: Blind SQL Injection in model.ajax.php via filters[groupOp] authentificated
Chamilo LMS is an open-source learning management system. Prior to 1.11.40 and 2.0.1, an authenticated administrator can call the getsessions action in /main/inc/ajax/model.ajax.php with search=true and a crafted JSON filters parameter whose groupOp field contains SQL syntax. Because groupOp is n...
CVE-2026-45146
An authenticated administrator can exploit a SQL injection vulnerability in Chamilo LMS prior to versions 1.11.40 and 2.0.1 . The issue exists in the get_sessions action within /main/inc/ajax/model.ajax.php when _search=true is used. Because the groupOp field in the JSON filters parameter is not ...
CVE-2026-45146 Chamilo LMS: Blind SQL Injection in model.ajax.php via filters[groupOp] authentificated
Chamilo LMS is an open-source learning management system. Prior to 1.11.40 and 2.0.1, an authenticated administrator can call the getsessions action in /main/inc/ajax/model.ajax.php with search=true and a crafted JSON filters parameter whose groupOp field contains SQL syntax. Because groupOp is n...
CVE-2026-95748
A SQL injection vulnerability exists in HPE Networking Fabric Composer . This flaw allows an unauthenticated adjacent attacker to execute arbitrary database commands . The provided documents do not specify the exact component, file, or version affected, nor do they provide specific remediation st...
EUVD-2026-116166
A SQL injection vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to run arbitrary database commands...
CVE-2026-95748 Unauthenticated Adjacent SQL Injection Vulnerability in HPE Networking Fabric Composer
A SQL injection vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to run arbitrary database commands...
CVE-2026-44265
Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, Elo's programmatic AST API accepts arbitrary values from JSON-deserialized input, plugin output, or other untyped sources and interpolates them into generated JavaScript, Ruby, Python, or SQL without runtime syntax...
CVE-2026-44265
The Elo expression language for no-code tools (versions prior to 1.0.1 ) contains a vulnerability in its programmatic AST API . The system fails to perform runtime syntax validation when interpolating arbitrary values from JSON-deserialized input , plugin outputs, or other untyped sources into ge...
CVE-2026-109594
Post-authentication Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability has been identified in the End-of-Life SonicWall GMS 9.5.2 and earlier versions which in specific conditions could potentially allow an authenticated attacker to access or modify...
Amelia (WordPress plugin): SQL Injection
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.10...
EUVD-2026-116040
Post-authentication Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability has been identified in the End-of-Life SonicWall GMS 9.5.2 and earlier versions which in specific conditions could potentially allow an authenticated attacker to access or modify...
CVE-2026-109594
A post-authentication SQL Injection vulnerability (CWE-89) exists in the End-of-Life SonicWall GMS version 9.5.2 and earlier. Under specific conditions, an authenticated attacker can access or modify information stored within the GMS database. No specific exploitation details or remediation steps...
CVE-2026-109594
Post-authentication Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability has been identified in the End-of-Life SonicWall GMS 9.5.2 and earlier versions which in specific conditions could potentially allow an authenticated attacker to access or modify...
CVE-2026-65139
NVIDIA Slurm contains an attacker-controlled SQL injection attack in certain SlurmDBD RPCs that can lead to arbitrary code execution...
CVE-2026-65139
NVIDIA Slurm is vulnerable to an attacker-controlled SQL injection attack within certain SlurmDBD RPCs . This vulnerability could potentially lead to arbitrary code execution . The issue was addressed in the Debian stable distribution (trixie) with version 24.11.5-4+deb13u1 . Exploitation details...