CVE-2026-14231 LifterLMS < 10.0.10 - Subscriber+ Sensitive Information Disclosure via select2_query_posts

The LifterLMS WordPress plugin before 10.0.10 does not perform a capability check in one of its select2 query AJAX handlers, only verifying that the user is logged in, allowing any authenticated user with subscriber-level access to read the titles of internal post types such as coupon codes by...

CVE-2026-15153 WP Hotel Booking < 2.3.2 - Hotel Manager+ SQL Injection via Booking List Search

The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query, allowing users holding the WP Hotel Booking WordPress plugin before 2.3.2's booking-management roles to perform SQL injection attacks...

CVE-2026-48448

Adobe Campaign Classic (ACC) is affected by an SQL Injection vulnerability (CWE-89) due to improper neutralization of special elements in SQL commands. The issue could allow an attacker to read files on the file system without user interaction, with CVSS v3.1 base metrics: AV:N/AC:L/PR:N/UI:N/S:C...

EUVD-2025-210533

Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in updatestudent.php via parameters fname and studentclass...

EUVD-2025-210535

Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in updatepassword.php via the parameter newpassword...

EUVD-2025-210539

kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /doctor/edit-patient.php?editid=1...

PHP 8.4.x < 8.4.24 Multiple Vulnerabilities SQLI

The version of PHP installed on the remote host is prior to 8.4.24. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.4.24 advisory. - Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8....

CVE-2025-69941

SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in addmeasurement.php?id=1...

EUVD-2025-210552

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the edittype.php endpoint via the Parameter id...

CVE-2025-69931

CVE-2025-69931 affects CodeAstro Membership Management System 1.0. A SQL Injection vulnerability is exposed in the endpoint /delete_membership.php?id=1, enabling an attacker to potentially manipulate the database. The CVSS v3.1 base score is 9.8 (CRITICAL), with impact on confidentiality, integri...

PT-2026-66589

Name of the Vulnerable Software and Affected Versions SourceCodester Tailor Management System version 1.0 Description An issue exists that allows SQL Injection, a technique where malicious SQL statements are inserted into entry fields for execution. This occurs at the 'customeredit.php' endpoint...

EUVD-2025-210563

SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in addmeasurement.php?id=1...

EUVD-2025-210554

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /editmember.php?id=1...

PT-2026-66588

Name of the Vulnerable Software and Affected Versions SourceCodester Tailor Management System version 1.0 Description An issue exists that allows SQL Injection, a technique where malicious SQL statements are inserted into entry fields for execution, via the 'addmeasurement.php' endpoint using the...

mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string()

A flaw was found in MariaDB server. An application processing non-validated user input, which then uses mysqlrealescapestring and sends data to the database via text protocol with the big5 character set, is vulnerable to SQL injection. This allows a remote attacker to execute malicious SQL...

EUVD-2026-50494

DriveLock SQL Injection Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of DriveLock. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP por...

CVE-2026-5490 DriveLock SQL Injection Privilege Escalation Vulnerability

DriveLock SQL Injection Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of DriveLock. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP por...

CVE-2026-8339

A SQL injection vulnerability exists in the Coverity Connect SOAP API for versions between 2024.6.0 and 2026.3.0 inclusive. A malicious, authenticated threat actor who sends a specially crafted payload can achieve full read access to database contents and other unauthorized commands...

CVE-2026-12895 SQL Injection in Frappe's ERPNext

SQL injection in Frappe's ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2. The application constructs SQL queries through direct string interpolation using str.format without employing parameterized queries, allowing the name docname of a Supplier record containing SQL metacharacters to be...

CVE-2026-12895

SQL injection in Frappe's ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2. The application constructs SQL queries through direct string interpolation using str.format without employing parameterized queries, allowing the name docname of a Supplier record containing SQL metacharacters to be...