265408 matches found
Exploit for CVE-2026-112866
CVE-2026-112866 - Product Filter by WBW Unauthenticated SQL In...
CVE-2026-116055
A vulnerability was detected in SourceCodester Performance Indicator System 1.0. This impacts an unknown function of the file /opils/admin/deleteproduct.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit is now public and may be...
SQL Injection
Overview Affected versions of this package are vulnerable to SQL Injection via the query parameter in SearchManager.php, which constructs a SQL SELECT statement without validating field property names. An unauthenticated attacker can supply a malicious field identifier containing SQL expressions...
SQL Injection
Overview Affected versions of this package are vulnerable to SQL Injection via the forcedDate parameter in includes/services/PageManager.php, where user-supplied input is interpolated directly into an SQL INSERT statement without validation. An attacker can inject arbitrary SQL by supplying a...
EUVD-2026-109547
A vulnerability was detected in SourceCodester Performance Indicator System 1.0. This impacts an unknown function of the file /opils/admin/deleteproduct.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit is now public and may be...
CVE-2026-116055 SourceCodester Performance Indicator System deleteproduct.php sql injection
A vulnerability was detected in SourceCodester Performance Indicator System 1.0. This impacts an unknown function of the file /opils/admin/deleteproduct.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit is now public and may be...
CVE-2026-116055 SourceCodester Performance Indicator System deleteproduct.php sql injection
A vulnerability was detected in SourceCodester Performance Indicator System 1.0. This impacts an unknown function of the file /opils/admin/deleteproduct.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit is now public and may be...
CVE-2026-116055
The SourceCodester Performance Indicator System 1.0 is vulnerable to an SQL injection vulnerability within an unknown function of the /opils/admin/deleteproduct.php file. By manipulating the ID argument, a remote attacker can execute arbitrary SQL commands. The documents state that the exploit is...
CVE-2026-116211
YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save, where the datemajfiche field of a Bazar entry-creation request is concatenated unescaped into an INSERT statement. Unauthenticated attackers on default installs can inject a sub-SELECT against wikiusers to...
CVE-2026-116207
YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest. Field names from the query and searchfields parameters of the public Bazar entries search API are placed in a backtick-quoted alias escap...
CVE-2026-116170
SiYuan before v3.8.7 contains an sql injection vulnerability that allows admin-token holders to read history.db by injecting unescaped op and type=3 query values. Attackers can send crafted UNION SELECT payloads to searchHistory or getHistoryItems endpoints to exfiltrate deleted document content,...
EUVD-2026-109467
YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save, where the datemajfiche field of a Bazar entry-creation request is concatenated unescaped into an INSERT statement. Unauthenticated attackers on default installs can inject a sub-SELECT against wikiusers to...
CVE-2026-116211 YesWiki 4.5.0 before 4.7.0 SQL Injection via date_maj_fiche in Bazar entry create
YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save, where the datemajfiche field of a Bazar entry-creation request is concatenated unescaped into an INSERT statement. Unauthenticated attackers on default installs can inject a sub-SELECT against wikiusers to...
CVE-2026-116211
YesWiki versions 4.5.0 before 4.7.0 are vulnerable to an SQL injection vulnerability within the PageManager::save() function. The issue occurs because the date_maj_fiche field from a Bazar entry-creation request is concatenated unescaped into an INSERT statement. This allows unauthenticated attac...
CVE-2026-116211 YesWiki 4.5.0 before 4.7.0 SQL Injection via date_maj_fiche in Bazar entry create
YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save, where the datemajfiche field of a Bazar entry-creation request is concatenated unescaped into an INSERT statement. Unauthenticated attackers on default installs can inject a sub-SELECT against wikiusers to...
CVE-2026-116211 YesWiki 4.5.0 before 4.7.0 SQL Injection via date_maj_fiche in Bazar entry create
YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save, where the datemajfiche field of a Bazar entry-creation request is concatenated unescaped into an INSERT statement. Unauthenticated attackers on default installs can inject a sub-SELECT against wikiusers to...
CVE-2026-116207 YesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search API
YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest. Field names from the query and searchfields parameters of the public Bazar entries search API are placed in a backtick-quoted alias escap...
CVE-2026-116207 YesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search API
YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest. Field names from the query and searchfields parameters of the public Bazar entries search API are placed in a backtick-quoted alias escap...
EUVD-2026-109465
YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest. Field names from the query and searchfields parameters of the public Bazar entries search API are placed in a backtick-quoted alias escap...
CVE-2026-116207 YesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search API
YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest. Field names from the query and searchfields parameters of the public Bazar entries search API are placed in a backtick-quoted alias escap...