EUVD-2026-72909

L-ONE v1.0.0 was discovered to contain multiple SQL injection vulnerabilities in the /attachment/getBusinessUploadList component via the busid, id, and taskid parameters. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...

CVE-2026-79573

L-ONE v1.0.0 is vulnerable to multiple SQL injection flaws within the /attachment/getBusinessUploadList component. The root cause is the improper neutralization of special elements in the busid , id , and taskid parameters. An attacker can exploit these vulnerabilities by submitting a crafted SQL...

CVE-2026-79573

L-ONE v1.0.0 was discovered to contain multiple SQL injection vulnerabilities in the /attachment/getBusinessUploadList component via the busid, id, and taskid parameters. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...

CVE-2026-79573

L-ONE v1.0.0 was discovered to contain multiple SQL injection vulnerabilities in the /attachment/getBusinessUploadList component via the busid, id, and taskid parameters. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...

CVE-2026-86075: Allocation of Resources Without Limits or Throttling

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the OAuth Dynamic Client Registration endpoint bounded redirecturis but accepted arbitrarily large clientname and granttypes values. An unauthenticated remote caller could repeatedly persist oversized values in...

CVE-2026-79570

mfish-nocode-pro v1.0.0 was discovered to contain a SQL injection vulnerability in the tableName parameter at /sys/dbConnect/data. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...

CVE-2026-79569

MovieRecommend v1.0.0 was discovered to contain a SQL injection vulnerability in the sort parameter at /loadingmore. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...

CVE-2026-79569

The Movie_Recommend v1.0.0 software is vulnerable to a SQL injection flaw within the sort parameter at the /loadingmore endpoint. This vulnerability exists because of improper neutralization of special elements used in an SQL command, which allows an attacker to execute a crafted SQL statement to...

PT-2026-87144

mfish-nocode-pro v1.0.0 was discovered to contain a SQL injection vulnerability in the tableName parameter at /sys/dbConnect/data. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...

EUVD-2026-72959

MovieRecommend v1.0.0 was discovered to contain a SQL injection vulnerability in the sort parameter at /loadingmore. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...

CVE-2026-79569

MovieRecommend v1.0.0 was discovered to contain a SQL injection vulnerability in the sort parameter at /loadingmore. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...

CVE-2026-77098: Improper Neutralization of Special Elements used in an SQL Command

Private Metrics Server contained an SQL injection condition affecting database operations. Software customers upgrade to resolved maintenance release. Update Private Metrics Server...

PT-2026-87099

A SQL injection vulnerability in the ap form id parameter in AppNitro MachForm v30 allows attackers to access sensitive database information via a crafted SQL statement...

CVE-2026-78837

AppNitro MachForm v30 is vulnerable to a remote SQL injection vulnerability within the ap_form_{id} parameter. An unauthenticated attacker can exploit the filter[filters][0][field] parameter in grid_datasource.php to execute crafted SQL statements. This flaw allows for the enumeration of valid co...

PT-2026-86948

SAP S/4HANA Intercompany Matching and Reconciliation allows a low-privileged authenticated user to inject malicious input into certain functions, which may be processed by the database without proper validation. This could allow the user to access sensitive information, resulting in high impact o...

PT-2026-88506

Impact The OAuth Dynamic Client Registration endpoints validated field sizes only for redirect uris, leaving client name and grant types bounded by presence checks alone. An unauthenticated remote caller could submit arbitrarily large values in either field and have them persisted to the database...

PT-2026-88180

A vulnerability was determined in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this issue is the function mysqli connect of the file config/database.php of the component Database Connection. This manipulation causes hard-coded credentials. The...

CVE-2026-79569: Improper Neutralization of Special Elements used in an SQL Command

MovieRecommend v1.0.0 was discovered to contain a SQL injection vulnerability in the sort parameter at /loadingmore. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...

CVE-2026-86135: Cross-Site Request Forgery (CSRF)

A Cross-Site Request Forgery CSRF vulnerability in WatchGuard Dimension's database snapshot creation feature allows a remote attacker to trigger unauthorized snapshot creation by tricking an authenticated administrator into visiting a specially crafted web page...

PT-2026-87104

A Cross-Site Request Forgery CSRF vulnerability in WatchGuard Dimension's database snapshot creation feature allows a remote attacker to trigger unauthorized snapshot creation by tricking an authenticated administrator into visiting a specially crafted web page...