265722 matches found
CVE-2026-110609
Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword parameter in the queryErpOrderItem MyBatis statement using raw $ substitution. Attackers can send crafted keyword values to the...
CVE-2026-110609
The Dromara Skyeye application (through commit 65d3ddcede70) is vulnerable to SQL Injection via the keyword parameter in the queryErpOrderItem MyBatis statement. The root cause is the use of raw ${} substitution instead of prepared statements. Authenticated low-privileged users can send crafted k...
EUVD-2026-101237
Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword parameter in the queryErpOrderItem MyBatis statement using raw $ substitution. Attackers can send crafted keyword values to the...
CVE-2026-94348
Dell PowerScale InsightIQ versions 5.2.0 through 6.3.0 are susceptible to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. A low privileged attacker with local access could exploit this flaw to cause a Denial of Service . No specific exploi...
CVE-2026-94348
Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service...
EUVD-2026-101030
Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service...
CVE-2026-108065 Unauthenticated SQL Injection in Channel Software WebAlliance eCommerce
SQL Injection CWE-89 in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce VERSION — missing allows an unauthenticated remote attacker to read, write, and potentially execute commands on the backend Microsoft SQL Server via a crafted sUserID...
EUVD-2026-101025
SQL Injection CWE-89 in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce VERSION — missing allows an unauthenticated remote attacker to read, write, and potentially execute commands on the backend Microsoft SQL Server via a crafted sUserID...
CVE-2026-108065 Unauthenticated SQL Injection in Channel Software WebAlliance eCommerce
SQL Injection CWE-89 in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce VERSION — missing allows an unauthenticated remote attacker to read, write, and potentially execute commands on the backend Microsoft SQL Server via a crafted sUserID...
CVE-2026-108065
Channel Software WebAlliance eCommerce is vulnerable to an unauthenticated SQL Injection (CWE-89) within the SOAP GetUser method of the /preapproval.asmx endpoint. An attacker can exploit this by providing a crafted sUserID parameter containing a single quote and a stacked SQL query. This vulnera...
Unauthenticated SQL Injection In Channel Software WebAlliance eCommerce
Overview While performing continuous red teaming exercises through Rapid7’s Vector Command service, Rapid7 discovered CVE-2026-108065, an SQL Injection vulnerability CWE-89 in Channel Software WebAlliance eCommerce.The exploit allows a malicious actor to read sensitive data from the database, or,...
CVE-2026-105067
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Webnus Modern Events Calendar Lite modern-events-calendar-lite allows Blind SQL Injection.This issue affects Modern Events Calendar Lite: from n/a before 7.37.0...
CVE-2026-105067
The Modern Events Calendar Lite WordPress plugin (versions before 7.37.0 ) is vulnerable to a Blind SQL Injection flaw. This issue stems from the improper neutralization of special elements used in SQL commands. The vulnerability allows an attacker with low-level privileges to potentially impact ...
EUVD-2026-100988
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Webnus Modern Events Calendar Lite modern-events-calendar-lite allows Blind SQL Injection.This issue affects Modern Events Calendar Lite: from n/a before 7.37.0...
CVE-2026-105067 WordPress Modern Events Calendar Lite plugin < 7.37.0 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Webnus Modern Events Calendar Lite modern-events-calendar-lite allows Blind SQL Injection.This issue affects Modern Events Calendar Lite: from n/a before 7.37.0...
CVE-2026-105067 WordPress Modern Events Calendar Lite plugin < 7.37.0 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Webnus Modern Events Calendar Lite modern-events-calendar-lite allows Blind SQL Injection.This issue affects Modern Events Calendar Lite: from n/a before 7.37.0...
CVE-2026-109901
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Codepeople CP Multi View Event Calendar cp-multi-view-calendar allows SQL Injection.This issue affects CP Multi View Event Calendar : from n/a through 1.4.41...
CVE-2026-105107
Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/catissuestop.pl script sub calculate concatenates the user-controlled Criteria, Filter, and Limit request parameters directly into dynamic SQL. Criteria is only prefix-normalized and never validated against an...
WordPress Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin <= 1.15.48 - Unauthenticated SQL Injection vulnerability
Unauthenticated SQL Injection vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin Form Maker by 10Web versions = 1.15.48...
WordPress JTL-Connector for WooCommerce plugin <= 2.4.3 - Unauthenticated SQL Injection vulnerability
Unauthenticated SQL Injection vulnerability discovered by Supakiad S. m3ez in WordPress Plugin JTL-Connector for WooCommerce versions = 2.4.3...