EUVD-2026-117471

A vulnerability was identified in itsourcecode Online Book Store 1.0. Affected by this issue is some unknown functionality of the file /adminedit.php. The manipulation of the argument bookisbn leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly availabl...

CVE-2026-123028 itsourcecode Online Book Store admin_edit.php sql injection

A vulnerability was identified in itsourcecode Online Book Store 1.0. Affected by this issue is some unknown functionality of the file /adminedit.php. The manipulation of the argument bookisbn with the input...

CVE-2026-123028

A SQL injection vulnerability exists in the itsourcecode Online Book Store 1.0 application. The flaw is located within an unknown functionality of the /admin_edit.php file, where the manipulation of the bookisbn argument allows for remote attack initiation. The documents indicate that an exploit ...

CVE-2026-105321 SQL Injection in Kobikom Telecommunications' Kobikom

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Kobikom Telecommunications and Informatics Services Inc. Kobikom allows SQL Injection. This issue affects Kobikom: before KobiPBX-FOP3-SEC-r1...

EUVD-2026-117438

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Kobikom Telecommunications and Informatics Services Inc. Kobikom allows SQL Injection. This issue affects Kobikom: before KobiPBX-FOP3-SEC-r1...

CVE-2026-105321

The software Kobikom by Kobikom Telecommunications and Informatics Services Inc. is vulnerable to an SQL injection (CWE-89) due to improper neutralization of special elements in SQL commands. This vulnerability affects versions before KobiPBX-FOP3-SEC-r1 . The security impact is rated as High wit...

blind-sql-bitshifting

Blind SQL Injection via Bitshifting This is a module that performs blind SQL injection by using the bitshifting method to calculate characters instead of guessing them. It requires 7/8 requests per character, depending on the configuration. Usage import blind-sql-bitshifting as x Edit this...

CVE-2026-107786

The CatFolders WordPress plugin before 2.5.7 does not properly sanitize and escape a user-controlled sort setting before using it in a SQL query, allowing authenticated users with upload capability Author and above to perform SQL injection attacks...

CVE-2026-100144

The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenticated attackers to read arbitrary data from the database...

EUVD-2026-117355

The CatFolders WordPress plugin before 2.5.7 does not properly sanitize and escape a user-controlled sort setting before using it in a SQL query, allowing authenticated users with upload capability Author and above to perform SQL injection attacks...

CVE-2026-107786 CatFolders < 2.5.7 - Author+ SQLi via 'sortFile' Setting

The CatFolders WordPress plugin before 2.5.7 does not properly sanitize and escape a user-controlled sort setting before using it in a SQL query, allowing authenticated users with upload capability Author and above to perform SQL injection attacks...

CVE-2026-107786

The CatFolders WordPress plugin (versions before 2.5.7 ) is vulnerable to SQL injection due to improper sanitization and escaping of a user-controlled sort setting. Specifically, the 'sortFile' setting is used in a SQL query without adequate security checks. This flaw allows authenticated users w...

EUVD-2026-117349

The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenticated attackers to read arbitrary data from the database...

CVE-2026-100144 IVPAY payments <= 1.0.8 - Unauthenticated SQLi via 'payment_id' Parameter

The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenticated attackers to read arbitrary data from the database...

CVE-2026-100144

The IVPAY payments WordPress plugin, affecting versions through 1.0.8 , is vulnerable to an unauthenticated SQL injection . The root cause is the lack of input sanitization on a value from the payment callback (specifically via the 'payment_id' parameter) before it is used in a SQL statement. Fur...

CVE-2026-122191

A vulnerability was determined in itsourcecode Airline Reservation System 1.0. This affects an unknown function of the file /admin/managebooked.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed...

CVE-2026-122191

The itsourcecode Airline Reservation System 1.0 is vulnerable to an SQL injection vulnerability within the /admin/manage_booked.php file. An attacker can exploit an unknown function by manipulating the ID argument to execute arbitrary SQL commands. This vulnerability can be triggered remotely, an...

CVE-2026-122191 itsourcecode Airline Reservation System manage_booked.php sql injection

A vulnerability was determined in itsourcecode Airline Reservation System 1.0. This affects an unknown function of the file /admin/managebooked.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed...

EUVD-2026-117321

A vulnerability was determined in itsourcecode Airline Reservation System 1.0. This affects an unknown function of the file /admin/managebooked.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed...

CVE-2026-122032

SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access to inject arbitrary SQL by submitting a differing where parameter value in the POST body versus the GET query string on the /ecrire/?exec=articles endpoint, bypassing...