PT-2026-123128

A vulnerability was found in itsourcecode Online Cake Ordering System 1.0. The affected element is an unknown function of the file /deletetransac.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit has been made public and could ...

itsourcecode Online Book Store input validation error vulnerability

The 1.0 version of itsourcecode Online Book Store contains a security vulnerability stemming from improper handling of the bookisbn parameter in the /book.php file, which may lead to SQL injection...

CVE-2026-31158

SQL Injection vulnerability in CRM SOFTTRADE Infotech aka softtradeindia 1.0 allows a remote attacker to execute arbitrary code via the Login Page...

CRM SOFTTRADE Infotech security vulnerability

CRM SOFTTRADE Infotech version 1.0 contains a security vulnerability stemming from SQL injection in its login page, which may allow remote attackers to execute arbitrary code...

CVE-2026-31158

SQL Injection vulnerability in CRM SOFTTRADE Infotech aka softtradeindia 1.0 allows a remote attacker to execute arbitrary code via the Login Page...

PT-2026-125519

OpenPanel before 3.0.0 contains an sql injection vulnerability in ConversionService.getConversion that allows project-read members and share-link holders to inject ClickHouse SQL through unescaped event names and dates. Attackers can break out of string literals in series names or startDate/endDa...

PT-2026-125518

OpenPanel before 3.0.0 contains a sql injection vulnerability in profileColumnAccess in cohort.service.ts that allows project-read members to inject SQL by supplying unescaped profile filter column names. Attackers can submit a cohort.preview filter whose name contains a subquery spliced into...

VulnCheck KEV: CVE-2026-16482

The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'compare' parameter in all versions up to, and including, 4.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

VulnCheck KEV: CVE-2026-66592

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Blind SQL Injection.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.7.11...

PT-2026-125498

A security vulnerability has been detected in itsourcecode Online Book Store 1.0. This vulnerability affects unknown code of the file /book.php. The manipulation of the argument bookisbn leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed...

PT-2026-125514

OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to read cross-tenant data by supplying a crafted property parameter to profile.values. Attackers can inject a SELECT expression with their own FROM/WHERE clauses and comment out the project id scope to...

PT-2026-123345

Vulnerability in the SQL storage module of Apache SIS. When sorting a stream of features, the clause is copied after ORDER BY without quoting the identifier character. A crafter sort clause could inject SQL in the query. This issue affects the sql-storage module of Apache SIS from version 1.0...

PT-2026-123327

Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-party bankaccounts REST endpoint. Attackers with only societe/creer permission can break out of the unescaped type value in...

PT-2026-123312

An SQL Injection vulnerability exists in the dashboard widget data API endpoint /api/data/type. Chart filter parameters supplied by the client are not properly validated before they are used in the database queries that build dashboard chart data. An authenticated user with API access can exploit...

Apache SIS SQL injection vulnerability

SQL injection vulnerabilities exist in Apache SIS versions 1.0 through 1.6. These vulnerabilities arise because the SQL storage module fails to reference identifier characters in clauses following ORDER BY when sorting feature streams. Specialized sorting clauses can be injected, potentially...

Hashen Open Source Doctor Appointment Booking System using PHP, MySQL input validation error vulnerability

The Hashen Open Source Doctor Appointment Booking System using PHP and MySQL contains a security vulnerability. This vulnerability stems from improper handling of the ‘spec’ parameter in the admin/add-new.php file, potentially leading to SQL injection and allowing remote attacks...

PT-2026-123263

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affects JetEngine: from n/a through 3.9.0...

CVE-2026-31158

The CRM SOFTTRADE Infotech (aka softtradeindia) 1.0 web application is vulnerable to an unauthenticated Boolean-based SQL Injection (CWE-89) in its login functionality. An attacker can exploit improper handling of user-supplied input in the TxtUsername parameter via a POST request to manipulate b...

WordPress Product Filter by WBW 3.4.6 SQL Injection

WordPress Product Filter by WBW versions through 3.4.6 contain an unauthenticated SQL injection vulnerability in the frontend filter AJAX flow. The proof of concept demonstrates attacker-controlled temporary-table identifier handling using a structural response oracle...

OpenProject SQL Injection

The vulnerability in the OpenProject project management platform is related to the lack of safeguards for SQL query structures. Exploitation of this vulnerability could allow a remote attacker to execute arbitrary code...