CVE-2026-47678

GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, any authenticated user can submit crafted values to the dropdown values fetching endpoint that are incorporated into a database query. This permits SQL injection through the dropdown endpoint. This issue...

CVE-2026-122038

A vulnerability was identified in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this issue is the function mysqlquery of the file source/reqformprocessing.php of the component Requirement Board Update Handler. Such manipulation leads to sql...

CVE-2026-122048

A vulnerability was identified in Campcodes Division Regional Athletic Meet Game Result Matrix System up to 2.1. This affects an unknown function of the file /dipam/check-user.php. Such manipulation of the argument abbr leads to sql injection. It is possible to launch the attack remotely. The...

CVE-2026-122048 Campcodes Division Regional Athletic Meet Game Result Matrix System check-user.php sql injection

A vulnerability was identified in Campcodes Division Regional Athletic Meet Game Result Matrix System up to 2.1. This affects an unknown function of the file /dipam/check-user.php. Such manipulation of the argument abbr leads to sql injection. It is possible to launch the attack remotely. The...

CVE-2026-122048

A vulnerability exists in the Campcodes Division Regional Athletic Meet Game Result Matrix System (up to version 2.1 ). The flaw is located in an unknown function within the /dipam/check-user.php file. Attackers can perform a remote SQL injection by manipulating the abbr argument. An exploit is p...

CVE-2026-122038

The krupalshah EmployeeRecruitmentSystem is vulnerable to a remote SQL injection via the mysql_query function in the source/reqformprocessing.php file within the Requirement Board Update Handler component. The vulnerability affects products up to commit 922ff6d208278282e7c8e36d70d9ae356adec9fe. E...

CVE-2026-47678 GLPI: Blind Time based SQLI in dropdowns

GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, any authenticated user can submit crafted values to the dropdown values fetching endpoint that are incorporated into a database query. This permits SQL injection through the dropdown endpoint. This issue...

CVE-2026-47678

The GLPI asset and IT management software package contains a blind time-based SQL injection vulnerability in its dropdown values fetching endpoint. Affected versions range from 9.4.0 up to, but not including, 10.0.26 and 11.0.8 . An authenticated user can submit crafted values that are improperly...

CVE-2025-71456

vtenext before 25.02.2 contains an SQL injection vulnerability that allows authenticated low-privileged users to inject SQL by supplying a crafted fieldname parameter to modules/Fax/EditView.php. Attackers can read arbitrary database contents, including password reset tokens stored in...

CVE-2025-71456 vtenext before 25.02.2 SQL Injection via fieldname in Fax EditView

vtenext before 25.02.2 contains an SQL injection vulnerability that allows authenticated low-privileged users to inject SQL by supplying a crafted fieldname parameter to modules/Fax/EditView.php. Attackers can read arbitrary database contents, including password reset tokens stored in...

CVE-2025-71456

The vtenext software (versions before 25.02.2 ) is vulnerable to an SQL injection flaw located in the modules/Fax/EditView.php component. This vulnerability exists because the application fails to properly neutralize the fieldname parameter. Authenticated users with low privileges can exploit thi...

EUVD-2025-211254

vtenext before 25.02.2 contains an SQL injection vulnerability that allows authenticated low-privileged users to inject SQL by supplying a crafted fieldname parameter to modules/Fax/EditView.php. Attackers can read arbitrary database contents, including password reset tokens stored in...

CVE-2026-113370

Sonatype Nexus Repository 3 contains a SQL injection vulnerability in the optional "Reindex Search Tables By Pattern" task. A user who holds the nexus:tasks:create privilege can supply a crafted filter condition that the database runs as SQL. This allows the user to modify data in the Nexus...

CVE-2026-113370

Sonatype Nexus Repository 3 contains a SQL injection vulnerability (CWE-89) within the optional **

EUVD-2026-117061

Sonatype Nexus Repository 3 contains a SQL injection vulnerability in the optional "Reindex Search Tables By Pattern" task. A user who holds the nexus:tasks:create privilege can supply a crafted filter condition that the database runs as SQL. This allows the user to modify data in the Nexus...

QNAP QTS - CVE-2022-27596 Exposure Detection

Detects QNAP NAS running vulnerable QTS 5.0.1 or QuTS hero h5.0.1 firmware before patched builds for CVE-2022-27596 unauthenticated SQL injection. Version is parsed from authLogin.cgi when exposed. !/usr/bin/env python3 -- coding: utf-8 -- """QNAP QTS 5.0.1 / QuTS hero h5.0.1 SQLi exposure...

DEBIAN-CVE-2026-122032

SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access to inject arbitrary SQL by submitting a differing where parameter value in the POST body versus the GET query string on the /ecrire/?exec=articles endpoint, bypassing...

CVE-2026-122032

SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access to inject arbitrary SQL by submitting a differing where parameter value in the POST body versus the GET query string on the /ecrire/?exec=articles endpoint, bypassing...

CVE-2026-121009

A flaw was found in SQL::Abstract. The library fails to enforce its injection validation guard when function names are specified using the explicit -func argument, placing the input directly into database queries without verification. A remote attacker who can control function name inputs in an...

CVE-2026-121007

A flaw was found in SQL::Abstract. When processing nested statements placed in identifier positions, the library inserts clause values directly into raw database queries rather than parameterizing them as bound values. If an application incorporates untrusted input into these nested queries, an...