PT-2026-121591

Name of the Vulnerable Software and Affected Versions AOS affected versions not specified Description A flaw in the web-based management interface allows an unauthenticated remote attacker to perform SQL injection. This occurs when the application fails to properly sanitize input, allowing...

PT-2026-120946

Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get events method, which fails to properly neutralize user-supplied input before including it in SQL queries. Authenticated attackers can send crafted input to get events and infer...

Progress MOVEit Transfer SQL Injection

Progress MOVEit Transfer contains an unauthenticated SQL injection vulnerability that could allow unauthorized access to database information and exposure of sensitive data...

VulnCheck KEV: CVE-2022-51023

PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameter. Attackers can send GET requests to /api.php?c=project&f=index with extractvalue payloads in sort to extract database information throug...

VulnCheck KEV: CVE-2024-58393

i-Netsolution Readymade Unilevel Ecommerce MLM 2024-03-15 build contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries through the 'id' parameter. Attackers can send GET requests to /product-details.php with boolean-based, stacked, or time-bas...

VulnCheck KEV: CVE-2022-51021

NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by supplying an array-form 'id' parameter to /wp-json/notificationx/v1/notification/id. Attackers can pass id1 with crafted SQ...

oretnom23 php-travel-agency-system input validation error vulnerability

The oretnom23 php-travel-agency-system contains a security vulnerability stemming from improper handling of parameters costomerid/paymenttype/amount/description/user/uploadimage/fullname/visano in the admin/insert.php file, which may lead to SQL injection...

Xu Xiangkun phpok SQL injection vulnerability

Versions prior to phpok 5.4.081, specifically version 4.5.000, contain an SQL injection vulnerability. This vulnerability stems from improper handling of the sort parameter, allowing unauthenticated attackers to exploit it by sending a GET request to /api.php?c=project&f=index containing a payloa...

Linux Distros Unpatched Vulnerability : CVE-2026-79752

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract,...

AlmaLinux 9.2 [TuxCare] Security Update: mariadb / mariadb-backup / mariadb-common / mariadb-devel / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792636681)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792636681 advisory. - MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and...

HPE ArubaOS security vulnerabilities

HPE ArubaOS 8 contains an SQL injection vulnerability stemming from unauthenticated SQL injection attempts in the PAPI protocol. This vulnerability may allow unauthenticated remote attackers to obtain and modify sensitive information stored in the underlying database, thereby disrupting the norma...

Drupal CSP log SQL injection vulnerability

Drupal CSP versions prior to 1.0.2 contain an SQL injection vulnerability. This vulnerability arises from improper neutralization of special elements within SQL commands, potentially leading to SQL injection attacks...

PT-2026-121339

SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist array parameter. Attackers can send GET requests to /comment/api/index.php with crafted rlist values using backtick-quoted...

HPE ArubaOS security vulnerabilities

A security vulnerability exists in HPE ArubaOS. It stems from a flaw in the affected interfaces, allowing unauthenticated remote attackers to perform SQL injection attacks on AOS-8 instances. Exploitation of this vulnerability enables arbitrary commands to be executed at the operating system leve...

HPE ArubaOS security vulnerabilities

A security vulnerability exists in HPE ArubaOS. It stems from an SQL injection flaw in affected interfaces. Unauthenticated remote attackers can exploit this vulnerability to perform SQL injection attacks on AOS-8 instances; successful exploitation allows attackers to execute arbitrary commands o...

TMS Amelia SQL injection vulnerability

TMS Amelia versions 2.4.11 and earlier contain an SQL injection vulnerability. This vulnerability stems from improper handling of special elements within SQL commands, making them susceptible to SQL injection attacks...

HPE ArubaOS security vulnerabilities

A security vulnerability exists in HPE ArubaOS. It stems from an SQL injection flaw in affected interfaces, allowing unauthenticated remote attackers to perform SQL injection attacks on AOS-10 instances. Successful exploitation of this vulnerability enables arbitrary commands to be executed on th...

PT-2026-121506

Name of the Vulnerable Software and Affected Versions Arista VeloCloud Orchestrator versions prior to 5.2.3.18 Arista VeloCloud Orchestrator versions prior to 6.1.3.10 Arista VeloCloud Orchestrator versions prior to 6.4.2.12 Description Arista VeloCloud Orchestrator VCO on-premises deployments...

PT-2026-121349

PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameter. Attackers can send GET requests to /api.php?c=project&f=index with extractvalue payloads in sort to extract database information throug...

PT-2026-121369

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric property name or categorical filter values. Attackers can embed SQL in values rendered unescaped into Jinja-generated counter, gauge and rat...