CVE-2026-113406

The BA-Workflow software developed by YS-infoware is vulnerable to a SQL Injection (CWE-89). This flaw allows authenticated remote attackers to inject arbitrary SQL statements, potentially resulting in the unauthorized reading, modification, or deletion of database contents. Specific information ...

EUVD-2026-104825

BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents...

CVE-2026-113406 YS-infoware｜BA-Workflow - SQL Injection

BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents...

CVE-2026-113406 YS-infoware｜BA-Workflow - SQL Injection

BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents...

CVE-2026-113405

The software BA-Workflow , developed by YS-infoware , is vulnerable to a SQL Injection (CWE-89). This flaw allows authenticated remote attackers to execute arbitrary SQL statements, potentially resulting in the ability to read, modify, and delete database contents . No specific affected versions,...

CVE-2026-113405 YS-infoware｜BA-Workflow - SQL Injection

BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents...

EUVD-2026-104824

BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents...

CVE-2026-113405 YS-infoware｜BA-Workflow - SQL Injection

BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents...

WordPress Amelia plugin <= 2.4.11 - SQL Injection vulnerability

SQL Injection vulnerability discovered by SVO in WordPress Plugin Amelia versions = 2.4.11...

WordPress EventON - Subscriber plugin <= 1.4.5 - Unauthenticated SQL Injection vulnerability

WordPress EventON - Subscriber plugin = 1.4.5 - Unauthenticated SQL Injection vulnerability discovered by Austin Ginder in WordPress Plugin EventON - Subscriber versions = 1.4.5...

CVE-2026-93300

The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...

EUVD-2026-104799

The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...

CVE-2026-93300 EventON - Subscriber <= 1.4.5 - Unauthenticated SQL Injection via 'email' Parameter

The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...

CVE-2026-93300

The EventON - Subscriber plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.4.5 . The root cause is insufficient escaping of the 'email' parameter and a lack of proper preparation for the existing SQL query. This flaw allows unauthenticated attackers to appe...

CVE-2026-93300 EventON - Subscriber <= 1.4.5 - Unauthenticated SQL Injection via 'email' Parameter

The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...

SUSE CVE-2026-86047

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A...

GO-2026-6672 Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query in github.com/sipcapture/homer-app

Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query in github.com/sipcapture/homer-app. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

PT-2026-118468

Configurable Reports block for Moodle moodle-block configurablereports before 5.3.1 contains an sql injection vulnerability in report sql::prepare sql via the filter var request parameter of viewreport.php. Low-privileged users permitted to view reports using the %%FILTER VAR%% placeholder can...

PT-2026-118262

BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents...

PT-2026-118310

The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters of the LIKE operator are escaped, quote characters are not. A crafted search term can therefore leave the intended string value and change the database query...