CVE-2026-108684

The erzhongxmu Jeewms software (up to version 3.7 ) is vulnerable to SQL injection due to improper handling of the searchVal argument within the Autocomplete Data Handler component. Specifically, the flaw exists in the getTreeData function located in src/main/java/com/jeecg/demo/controller/JeecgF...

EUVD-2026-97064

A vulnerability was detected in erzhongxmu Jeewms up to 3.7. This affects the function getTreeData of the file src/main/java/com/jeecg/demo/controller/JeecgFormDemoController.java of the component Autocomplete Data Handler. Performing a manipulation of the argument searchVal results in sql...

Astra Linux – Vulnerability in Python 3.11, Python 3.7

User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL’s media type...

CVE-2026-103117

A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function dbproperties of the file functions/DatabaseInc.php of the component Save Data Handler. Such manipulation of the argument values leads to sql injection. The attack can be launched remotely. The...

CVE-2026-103117 OS4ED openSIS-Classic Save Data DatabaseInc.php db_properties sql injection

A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function dbproperties of the file functions/DatabaseInc.php of the component Save Data Handler. Such manipulation of the argument values leads to sql injection. The attack can be launched remotely. The...

CVE-2026-103117

A security vulnerability exists in OS4ED openSIS-Classic up to version 9.3. The flaw is located in the db_properties function within the functions/DatabaseInc.php file of the Save Data Handler component. Improper handling of argument values allows for a remote SQL injection attack. While the expl...

EUVD-2026-89949

A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function dbproperties of the file functions/DatabaseInc.php of the component Save Data Handler. Such manipulation of the argument values leads to sql injection. The attack can be launched remotely. The...

CVE-2026-103117 OS4ED openSIS-Classic Save Data DatabaseInc.php db_properties sql injection

A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function dbproperties of the file functions/DatabaseInc.php of the component Save Data Handler. Such manipulation of the argument values leads to sql injection. The attack can be launched remotely. The...

CVE-2026-103117 OS4ED openSIS-Classic Save Data DatabaseInc.php db_properties sql injection

A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function dbproperties of the file functions/DatabaseInc.php of the component Save Data Handler. Such manipulation of the argument values leads to sql injection. The attack can be launched remotely. The...

CVE-2026-103117: Improper Neutralization of Special Elements used in an SQL Command

A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function dbproperties of the file functions/DatabaseInc.php of the component Save Data Handler. Such manipulation of the argument values leads to sql injection. The attack can be launched remotely. The...

PT-2026-103269

A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function db properties of the file functions/DatabaseInc.php of the component Save Data Handler. Such manipulation of the argument values leads to sql injection. The attack can be launched remotely. The...

CVE-2026-82304 Music Store – WordPress eCommerce < 1.4.5 - Unauthenticated SQLi via paypal-data Handler

The Music Store WordPress plugin before 1.4.5 does not sanitise and escape user input before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

CVE-2026-82304

The Music Store WordPress plugin (versions before 1.4.5 ) is vulnerable to an unauthenticated SQL injection (SQLi). The root cause is the failure to sanitise and escape user input before its inclusion in a SQL statement. Specifically, the vulnerability exists within the paypal-data handler. An un...

CVE-2026-82304 Music Store – WordPress eCommerce < 1.4.5 - Unauthenticated SQLi via paypal-data Handler

The Music Store WordPress plugin before 1.4.5 does not sanitise and escape user input before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

FunAudioLLM InspireMusic deserialization vulnerability

A vulnerability was found in FunAudioLLM InspireMusic up to bf32364bcb0d136497ca69f9db622e9216b029dd. It has been classified as critical. Affected is the function loadstatedict of the file inspiremusic/cli/model.py of the component Pickle Data Handler. The manipulation leads to deserialization. A...

PYSEC-2026-1464 FunAudioLLM InspireMusic deserialization vulnerability

A vulnerability was found in FunAudioLLM InspireMusic up to bf32364bcb0d136497ca69f9db622e9216b029dd. It has been classified as critical. Affected is the function loadstatedict of the file inspiremusic/cli/model.py of the component Pickle Data Handler. The manipulation leads to deserialization. A...

Missing Authorization

Overview typo3/cms-form is a Form Library, Plugin and Editor Affected versions of this package are vulnerable to Missing Authorization via the DataHandler. An attacker can execute unauthorized database queries and gain elevated privileges by directly manipulating form definition records, bypassin...

EUVD-2026-35402

TYPO3 CMS has Privilege Escalation & SQL Injection in its Form Framework...

TYPO3 CMS has Broken Access Control in its DataHandler

Problem Backend users were able to move records to a different page without having edit permissions on the source page. Solution Update to TYPO3 versions 13.4.31 LTS, 14.3.3 LTS that fix the problem described. Credits TYPO3 CMS thanks Hyunseo Shin for reporting this issue, and TYPO3 security team...

CVE-2026-49741 TYPO3 CMS - Privilege Escalation & SQL Injection in Form Framework

Backend users with write access to the formdefinition database table were able to directly create, update, or delete form definition records via DataHandler, bypassing the Form Framework's persistence validation and permission checks. This allowed injecting arbitrary form configurations,...