Adobe Campaign Classic SQL Injection Vulnerability

Adobe Campaign Classic is a marketing activity management platform developed by the American company Adobe. Adobe Campaign Classic has a SQL injection vulnerability, which stems from improper handling of special elements in SQL commands. Attackers can exploit this vulnerability to gain access to...

PT-2026-66716

The Product Feed Manager For WooCommerce WordPress plugin before 7.6.1 does not properly sanitise and escape product-feed custom filter rules before using them in a SQL query, allowing users with the Contributor role and above to perform SQL injection attacks...

CVE-2025-69948: Improper Neutralization of Special Elements used in an SQL Command

SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin/deletegroup.php?id=1...

CVE-2025-69946

SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in ajaxData.php via the parameters districtid , divisionid, regionid, and wardid...

CVE-2025-69946

SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in ajaxData.php via the parameters districtid , divisionid, regionid, and wardid...

CVE-2025-69946

SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in ajaxData.php via the parameters districtid , divisionid, regionid, and wardid...

CVE-2025-69948

SourceCodester Modern Loan Management System version 1.0 is vulnerable to SQL Injection via the id parameter at the /admin/delete group.php endpoint. This flaw allows for the insertion of malicious SQL statements for execution. To remediate the vulnerability, users should update the software to a...

CVE-2026-45376: Improper Neutralization of Special Elements used in an SQL Command

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET /admin/organization/users search interpolates params:term into raw Arel.sql ORDER BY similarity expressions before sanitization, allowing an authenticated...

CVE-2026-17346: Improper Neutralization of Special Elements used in an SQL Command

The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and switched sixteen COMMENT ON / pgstattuple / pgstatindex templates to it, but missed several sinks that had been placed in testsqlstringliterallint.py's ALLOWLIST on the incorrect assumption that schema, table, publication, and...

CVE-2026-14554: Improper Neutralization of Special Elements used in an SQL Command

The Check & Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privileges to perform SQL injection attacks...

Linux Distros Unpatched Vulnerability : CVE-2026-63221

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch substitutes bound values from where conditions into generated...

CVE-2026-15381: Improper Neutralization of Special Elements used in an SQL Command

The WP Go Maps WordPress plugin before 10.1.04 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-62845

Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, the PostgreSQL and MySQL datastore drivers build DDL statements by interpolating the user-supplied DataStoreUsername/DataStoreSchema directly into SQL via fmt.Sprintf, without escaping identifiers. These fields have ...

CVE-2025-69938

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in renew.php via the parameter membershipType...

CVE-2025-69937

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the edittype.php endpoint via the Parameter id...

CVE-2025-69941

SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in addmeasurement.php?id=1...

CVE-2025-69947

SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in customeredit.php?id=1...

CVE-2025-69936

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /editmember.php?id=1...

CVE-2025-65336

Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL Injection in /showpricebypdtId.php...

EUVD-2026-51312

Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, the PostgreSQL and MySQL datastore drivers build DDL statements by interpolating the user-supplied DataStoreUsername/DataStoreSchema directly into SQL via fmt.Sprintf, without escaping identifiers. These fields have ...