EUVD-2026-58133

SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in received electronic invoices. When importing a received e-invoice UBL/PEPPOL or an e-commerce export, Zalktis concatenates partner-controlled values directly into SQL statement text using string...

U.S. Dept Of Defense: Blind SQL Injection on DoD Site

Hi There, One of the DoD Site is vulnerable to blind sql injection. Affected Domain: www.███ PoC: Navigate to below url http://www.█████████/viewVideo.asp?t=7 Just replace 7 with pgsleep30-- GET /viewVideo.asp?t=pgsleep30-- As a response you can see time delay compared with viewVideo.asp?t=7 Time...