EUVD-2026-106884

Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without allowlisting or escaping. Authenticated customers can submit a backtick-quoted identifier to POST /api/v1/query that injects ...

PT-2026-120465

The Swift Performance Lite WordPress plugin before 2.3.7.4 does not properly sanitize and escape a value before using it in a SQL statement, which could allow users with the author role and above to perform SQL injection attacks...

PT-2026-120554

A security flaw has been discovered in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected by this vulnerability is the function mysqli query of the file /Agent/ManagePolicy/EditPolicyHolder.php. Performing a...

PT-2026-120207

Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without allowlisting or escaping. Authenticated customers can submit a backtick-quoted identifier to POST /api/v1/query that injects ...

PT-2026-120841

A security vulnerability has been detected in itsourcecode Online Cake Ordering System 1.0. Affected is an unknown function of the file /transactionsave.php. Such manipulation of the argument del leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly...

PT-2026-120843

A vulnerability was identified in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/delete.php. The manipulation of the argument costomer id/ticket id/payment id/id/document id/salary id/emp id/user id leads to sql injection. The attack can be initiated remotely...

PT-2026-120739

A security flaw has been discovered in ProjectWorlds Advanced Library Management System 1.0. The impacted element is an unknown function of the file edit member.php. Performing a manipulation of the argument firstname/middlename/lastname/address/branch/type results in sql injection. Remote...

PT-2026-120288

A flaw has been found in itsourcecode Online Cake Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /deletecustomer.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been...

PT-2026-120824

Name of the Vulnerable Software and Affected Versions itsourcecode Online Cake Ordering System version 1.0 Description A remote SQL injection is possible due to improper handling of the prcd variable within the /inserttrans.php endpoint. SQL injection is a technique where an attacker inserts...

PT-2026-120634

A vulnerability has been found in itsourcecode Sales-and-Inventory-System up to 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac. Impacted is an unknown function of the file /pages/cust del.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit...

PT-2026-120625

A flaw has been found in itsourcecode Sales-and-Inventory-System up to 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac. This issue affects some unknown processing of the file /pages/cust edit.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploi...

oretnom23 file-management-system-php input validation error vulnerability

The oretnom23 file-management-system-php versions 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 and earlier contain a security vulnerability. This vulnerability stems from improper handling of the fid/id parameter in the files.php component within the File Management module, potentially leading to SQL...

oretnom23 php-travel-agency-system input validation error vulnerability

The oretnom23 php-travel-agency-system contains a security vulnerability stemming from improper handling of parameters costomerid/ticketid/paymentid/id/documentid/salaryid/empid/userid in the file admin/delete.php. This may lead to SQL injection attacks...

itsourcecode Online Cake Ordering System input validation error vulnerability

The 1.0 version of itsourcecode’s Online Cake Ordering System contains a security vulnerability stemming from improper handling of the ID parameter in the /orderdetail.php file, which may lead to SQL injection...

itsourcecode Online Cake Ordering System input validation error vulnerability

The 1.0 version of itsourcecode’s Online Cake Ordering System contains a security vulnerability stemming from improper handling of the prcd parameter in the /inserttrans.php file, which may lead to SQL injection...

PT-2026-121794

Name of the Vulnerable Software and Affected Versions Participants Database versions prior to 2.7.8.6 Description An issue involving improper neutralization of special elements used in an SQL command allows for Blind SQL Injection. Blind SQL Injection is a technique where an attacker asks the...

PT-2026-120210

Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint, which concatenates the unescaped tags query parameter into the ElectricSQL shape where clause and defeats the runtimeEnvironmentId tenant guard. Authenticated attackers holding any project API key...

PT-2026-120444

The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL...

PT-2026-120669

A security vulnerability has been detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this vulnerability is the function readfile of the file download.php of the component File Download. Such manipulation of the argument ID leads to sql...

PT-2026-120678

A vulnerability was detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this issue is some unknown functionality of the file files.php of the component File Management. Performing a manipulation of the argument fid/id results in sql...