CVE-2026-61653 SuiteCRM: SQL injection via id param in modules/Campaigns/PopupCampaignRoi.php

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, modules/Campaigns/PopupCampaignRoi.php interpolates $REQUEST'id' into SQL. Although securexss normally entity-encodes quotes, an input prefixed with an XSS payload...

CVE-2026-61653

SuiteCRM versions prior to 7.15.2 and 8.10.2 are vulnerable to a SQL injection flaw in the modules/Campaigns/PopupCampaignRoi.php component. The root cause is the improper interpolation of $_REQUEST['id'] into a SQL query. While the securexss() function typically encodes quotes, a specific input ...

CVE-2026-63215 SuiteCRM: Time-Based Blind SQL Injection via REST API

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the REST API v4.1 getentrylist method is vulnerable to time-based blind SQL injection when an authenticated caller simultaneously bypasses two independent security...

CVE-2026-63215

The SuiteCRM CRM software is vulnerable to a time-based blind SQL injection in the REST API v4.1 get_entry_list method prior to versions 7.15.2 and 8.10.2 . An authenticated caller can trigger this vulnerability by simultaneously bypassing two unspecified security mechanisms. Successful exploitat...

CVE-2026-63214 SuiteCRM: Authenticated SQL Injection in v4_1 get_entry_list rest api

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, legacy REST methods append an authenticated caller's query parameter as a SQL WHERE clause after insufficient structural validation. The affected flow begins at...

CVE-2026-63214

SuiteCRM is vulnerable to an authenticated SQL injection in legacy REST methods (prior to versions 7.15.2 and 8.10.2). The vulnerability exists because query parameters are appended as a SQL WHERE clause without sufficient structural validation. The affected flow begins at /service/v4_1/rest.php ...

CVE-2026-61651

SuiteCRM is vulnerable to an authenticated SQL injection in the get_end_date action within the Projects Controller in versions prior to 7.15.2 and 8.10.2 . The root cause is the lack of parameterization when the application concatenates an authenticated caller's task_id value into a SQL query. A ...

CVE-2026-61651 SuiteCRM: Authenticated SQL Injection in get_end_date function in Project Controller

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the getenddate action in Projects Controller concatenates an authenticated caller's taskid value into a SQL query without parameterization. A low-privileged user can...

CVE-2024-50972

CVE-2024-50972 Description A SQL injection vulnerability in printtool.php of Itsourcecode Construction Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the borrowid parameter. Vulnerability Type SQL Injection Vendor of Product Itsourcecode Affected Product Code...

whitewidow

Preamble Firstly readthis if you want Whitewidow development to continue. Hello all you whitewidow fans out there I say that with good intentions I promise!. It's me Ekultek, I'm just here to give you a little inside on what's going on with the whitewidow development team and what's happening wit...

CVE-2026-81815

SQL Injection in the entity engine's generic performFind service in Apache OFBiz 24.09 before 24.09.08 on MySQL/MariaDB-backed deployments allows a remote unauthenticated attacker to disclose arbitrary rows from the queried entity by submitting an ignore-case find request e.g. ic=Y with a crafted...

CVE-2026-115738

SQL injection vulnerability in DLP on-prem extensions version 11.13.1 and earlier allows a remote authenticated attacker to inject SQL queries without sanitization or parameterized queries...

CVE-2026-115738

SQL injection vulnerability in DLP on-prem extensions version 11.13.1 and earlier allows a remote authenticated attacker to inject SQL queries without sanitization or parameterized queries...

EUVD-2026-117530

SQL injection vulnerability in DLP on-prem extensions version 11.13.1 and earlier allows a remote authenticated attacker to inject SQL queries without sanitization or parameterized queries...

CVE-2026-115738

A SQL injection vulnerability exists in DLP on-prem extensions version 11.13.1 and earlier . The flaw allows a remote authenticated attacker to inject SQL queries because the application fails to use sanitization or parameterized queries . The vulnerability is associated with CWE-89 and carries a...

CVE-2026-123028

A vulnerability was identified in itsourcecode Online Book Store 1.0. Affected by this issue is some unknown functionality of the file /adminedit.php. The manipulation of the argument bookisbn with the input...

CVE-2026-105321

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Kobikom Telecommunications and Informatics Services Inc. Kobikom allows SQL Injection. This issue affects Kobikom: before KobiPBX-FOP3-SEC-r1...

CVE-2026-81815

Apache OFBiz versions 24.09 before 24.09.08 are vulnerable to SQL injection in the entity engine's generic performFind service when using MySQL/MariaDB backends. The root cause is that SqlJdbcUtil.addValueSingle inlines values directly into the SQL text using ANSI-only single-quote doubling inste...

EUVD-2026-117483

SQL Injection in the entity engine's generic performFind service in Apache OFBiz 24.09 before 24.09.08 on MySQL/MariaDB-backed deployments allows a remote unauthenticated attacker to disclose arbitrary rows from the queried entity by submitting an ignore-case find request e.g. ic=Y with a crafted...

CVE-2026-123028 itsourcecode Online Book Store admin_edit.php sql injection

A vulnerability was identified in itsourcecode Online Book Store 1.0. Affected by this issue is some unknown functionality of the file /adminedit.php. The manipulation of the argument bookisbn with the input...