Windows Server 2025 Active Directory Certificate Services Subject Key Identifier Injection

Windows Server 2025 Active Directory Certificate Services contains a weak authentication issue that allows an authorized attacker to inject an arbitrary Subject Key Identifier into a certificate signing request. https://packetstorm.news/download/237875...

CVE-2026-107081

SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints admin/AJAXlookuphandler.php, admin/AJAXcheckid.php, admin/AJAXvocabolarycontrol.php in SENAYAN Library Management System SLiMS Bulian 9.8.0 allows any authenticated staff user to extrac...

CVE-2026-107081

SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints admin/AJAXlookuphandler.php, admin/AJAXcheckid.php, admin/AJAXvocabolarycontrol.php in SENAYAN Library Management System SLiMS Bulian 9.8.0 allows any authenticated staff user to extrac...

CVE-2026-107081

The SENAYAN Library Management System (SLiMS) Bulian 9.8.0 is vulnerable to SQL injection via identifier injection in three admin AJAX endpoints: admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php, and admin/AJAX_vocabolary_control.php. The root cause is the direct interpolation of tableName ...

CVE-2026-107081: Undefined Security Weakness

SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints admin/AJAXlookuphandler.php, admin/AJAXcheckid.php, admin/AJAXvocabolarycontrol.php in SENAYAN Library Management System SLiMS Bulian 9.8.0 allows any authenticated staff user to extrac...

Exploit for CVE-2026-107081

CVE-2026-107081 — SQL Injection via Identifier Injection in SL...

CVE-2026-63154

Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying caller-controlled agoraFields names as unvalidated SQL column identifiers during the user import flow. Attackers can inject privileged...

CVE-2026-63154 Omnispace Agora Project < 26.10.0 SQL Identifier Injection via agoraFields[]

Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying caller-controlled agoraFields names as unvalidated SQL column identifiers during the user import flow. Attackers can inject privileged...

CVE-2026-63154

Omnispace Agora Project versions prior to 26.10.0 are vulnerable to a SQL identifier injection vulnerability during the user import flow. The root cause is the use of unvalidated caller-controlled agoraFields[] names as SQL column identifiers. A space administrator can exploit this to escalate pr...

EUVD-2026-100567

Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying caller-controlled agoraFields names as unvalidated SQL column identifiers during the user import flow. Attackers can inject privileged...

CVE-2026-63154 Omnispace Agora Project < 26.10.0 SQL Identifier Injection via agoraFields[]

Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying caller-controlled agoraFields names as unvalidated SQL column identifiers during the user import flow. Attackers can inject privileged...

CVE-2026-63154 Omnispace Agora Project < 26.10.0 SQL Identifier Injection via agoraFields[]

Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying caller-controlled agoraFields names as unvalidated SQL column identifiers during the user import flow. Attackers can inject privileged...

CVE-2026-63154

Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying caller-controlled agoraFields names as unvalidated SQL column identifiers during the user import flow. Attackers can inject privileged...

CVE-2026-63154: Improper Neutralization of Special Elements used in an SQL Command

Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying caller-controlled agoraFields names as unvalidated SQL column identifiers during the user import flow. Attackers can inject privileged...

PT-2026-113333

Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying caller-controlled agoraFields names as unvalidated SQL column identifiers during the user import flow. Attackers can inject privileged...

CVE-2026-54646 CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.php

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablename values into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE statements without validating the identifiers or escaping embedded backticks. An authenticated...

CVE-2026-54646 CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.php

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablename values into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE statements without validating the identifiers or escaping embedded backticks. An authenticated...

CVE-2026-88024

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Rust Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

CubeCart 6.7.4 SQL Injection

CubeCart version 6.7.4 suffers from multiple remote SQL injection vulnerabilities. Exploit Title: CubeCart 6.7.4 - SQL Bypass in maintenance.index.inc.php Date: 2026-06-08 Exploit Author: Mikail Kocadağ Vendor Homepage: https://www.cubecart.com/ Software Link: https://github.com/cubecart/v6...

CVE-2026-77586

In MongoDB Connector for BI , object names (collections, fields, indexes) are embedded into the DDL output of SHOW CREATE statements without escaping the identifier delimiter. A user with write access to a sampled collection can craft a name that closes the quoted identifier early, injecting arbi...