CVE-2026-64618 Apache Fineract: SQL injection vulnerability in Search API

Improper Neutralization of Special Elements used in an SQL Command "SQL Injection" vulnerability exists in Apache Fineract through version 1.15.0. The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowi...

EUVD-2026-113752

Improper Neutralization of Special Elements used in an SQL Command "SQL Injection" vulnerability exists in Apache Fineract through version 1.15.0. The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowi...

CVE-2026-65874 Apache Fineract: SQL injection via ORDER BY parameters in the Center and datatables endpoints

This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint GET /api/v1/centers and the datatable entry read endpoints GET /api/v1/datatables/datatable/apptableId and GET /api/v1/datatables/datatable/apptableId/datatableId concatenate caller-supplied ordering...

CVE-2026-65874

This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint GET /api/v1/centers and the datatable entry read endpoints GET /api/v1/datatables/datatable/apptableId and GET /api/v1/datatables/datatable/apptableId/datatableId concatenate caller-supplied ordering...

EUVD-2026-113749

This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint GET /api/v1/centers and the datatable entry read endpoints GET /api/v1/datatables/datatable/apptableId and GET /api/v1/datatables/datatable/apptableId/datatableId concatenate caller-supplied ordering...

CVE-2026-65874 Apache Fineract: SQL injection via ORDER BY parameters in the Center and datatables endpoints

This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint GET /api/v1/centers and the datatable entry read endpoints GET /api/v1/datatables/datatable/apptableId and GET /api/v1/datatables/datatable/apptableId/datatableId concatenate caller-supplied ordering...

CVE-2026-65874

This vulnerability affects Apache Fineract versions up to and including 1.15.0 . The issue stems from the Center read endpoint and datatable entry read endpoints directly concatenating caller-supplied ordering parameters (orderBy , sortOrder , order ) into the SQL ORDER BY clause. Because the exi...

CVE-2023-36645

== Affected Software %hardbreaks Vendor: ITB-GmbH Affected Products: TradePro v9.5 Component: Function Customer; Action oordershow Confirmed: yes == Attack Vector %hardbreaks Type: SQLi Access-Type: Remote Impact: Information Disclosure; Escalation of Privileges SQL injection in function customer...

WordPress Transliterator plugin <= 2.5.13 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Mor Golan in WordPress Plugin Transliterator versions = 2.5.13...

CVE-2026-118698

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Injection via the 'pgroup' parameter in all versions up to, and including, 5.7.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

CVE-2026-117572

The WP Visitor Statistics Real Time Traffic WordPress plugin before 8.8 does not sanitize and escape a parameter before using it in a SQL statement, allowing high-privilege users such as administrators to perform SQL injection attacks...

CVE-2026-117572 WP Visitor Statistics (Real Time Traffic) < 8.8 - Admin+ SQLi via 'order' Parameter

The WP Visitor Statistics Real Time Traffic WordPress plugin before 8.8 does not sanitize and escape a parameter before using it in a SQL statement, allowing high-privilege users such as administrators to perform SQL injection attacks...

CVE-2026-117572

The WP Visitor Statistics (Real Time Traffic) WordPress plugin in versions before 8.8 is vulnerable to SQL injection . The root cause is the failure to properly sanitize and escape the 'order' parameter before utilizing it in a SQL statement. This flaw allows users with high privileges, such as a...

EUVD-2026-113727

The WP Visitor Statistics Real Time Traffic WordPress plugin before 8.8 does not sanitize and escape a parameter before using it in a SQL statement, allowing high-privilege users such as administrators to perform SQL injection attacks...

CVE-2026-117572 WP Visitor Statistics (Real Time Traffic) < 8.8 - Admin+ SQLi via 'order' Parameter

The WP Visitor Statistics Real Time Traffic WordPress plugin before 8.8 does not sanitize and escape a parameter before using it in a SQL statement, allowing high-privilege users such as administrators to perform SQL injection attacks...

CVE-2020-25273

CVE-2020-25273 Online Bus Booking System 1.0, there is Authentication bypass on the Admin Login screen in admin.php via username or password SQL injection. Vendor - SourceCodester Product -https://www.sourcecodester.com/php/14438/online-bus-booking-system-project-using-phpmysql.html V 1.0...

CVE-2026-118698

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress (versions up to and including 5.7.14 ) is vulnerable to a SQL Injection flaw. The root cause is insufficient escaping of the user-supplied pgroup parameter and a lack of proper preparation on the existing SQL ...

CVE-2026-118698 JoomSport <= 5.7.14 - Authenticated (Contributor+) SQL Injection via 'pgroup' Shortcode Attribute

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Injection via the 'pgroup' parameter in all versions up to, and including, 5.7.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

EUVD-2026-113713

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Injection via the 'pgroup' parameter in all versions up to, and including, 5.7.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

CVE-2026-118698 JoomSport <= 5.7.14 - Authenticated (Contributor+) SQL Injection via 'pgroup' Shortcode Attribute

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Injection via the 'pgroup' parameter in all versions up to, and including, 5.7.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...