CVE-2026-16490: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in itsourcecode Hospital Management System 1.0. Impacted is an unknown function of the file /prescription.php. The manipulation of the argument editid results in sql injection. The attack can be executed remotely. The exploit has been released to the public and...

Tenable Security Center Multiple Vulnerabilities (TNS-2026-19)

According to its self-reported version, the Tenable Security Center running on the remote host is between 6.6.0 and 6.8.0. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2026-19 advisory. - Tenable Security Center is affected by a SQL injection vulnerability...

CVE-2026-16484

A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /editsubjecta.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published...

GHSA-2RP8-MM9Q-FP49 TypeORM: migration:generate template-literal code injection

Summary typeorm migration:generate embeds database schema metadata into JS/TS template literals, escaping backticks but not $.... An attacker who can write schema metadata column comments, defaults, view definitions achieves arbitrary code execution on the host that loads the generated migration...

@142vip/midway (>=0.1.6-alpha.9, <=0.1.6-alpha.12), @142vip/nest-starter (>=0.0.1-alpha.1, <=0.0.1-alpha.13) +2876 more potentially affected by unknown CVE via typeorm (>=0.0.2-alpha.43, <=0.3.30)

typeorm NPM version =0.0.2-alpha.43, =0.1.6-alpha.9, =0.0.1-alpha.1, =0.0.1-alpha.1, =1.0.1, =3.3.4, =1.0.1, =0.0.1, =0.9.3, =1.0.0, =1.1.126, =1.0.0, =1.0.0, =1.0.14 - @actonate/mirkwood 0.10.1 and more Source cves: unknown CVE Source advisory: SNYK:JS-TYPEORM-18170276...

@atlantjs/backend (>=11.0.11, <=11.0.79), @atlantjs/database (>=2.0.0, <=2.1.32) +6 more potentially affected by unknown CVE via typeorm (1.0.0)

typeorm NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on typeorm and may be impacted: - @atlantjs/backend =11.0.11, =2.0.0, =0.48.60, =1.6.5, =2.1.5, =0.2.0, =1.1.43, =1.1.45 Source cves: unknown CVE Source advisory:...

@142vip/midway (>=0.1.6-alpha.9, <=0.1.6-alpha.12), @142vip/nest-starter (>=0.0.1-alpha.1, <=0.0.1-alpha.13) +2876 more potentially affected by CVE-2026-73651 via typeorm (>=0.0.2-alpha.43, <=0.3.30)

typeorm NPM version =0.0.2-alpha.43, =0.1.6-alpha.9, =0.0.1-alpha.1, =0.0.1-alpha.1, =1.0.1, =3.3.4, =1.0.1, =0.0.1, =0.9.3, =1.0.0, =1.1.126, =1.0.0, =1.0.0, =1.0.14 - @actonate/mirkwood 0.10.1 and more Source cves: CVE-2026-73651 Source advisory: OSV:GHSA-2RP8-MM9Q-FP49...

EUVD-2026-46431

Aptabase through commit 5a89368 contains a SQL injection vulnerability in the ClickHouse query backend that allows authenticated attackers to read event data across all tenants by injecting unsanitized filter parameters into Liquid SQL templates. Attackers can supply malicious values through...

CVE-2026-16484 SourceCodester Class and Exam Timetabling System edit_subjecta.php sql injection

A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /editsubjecta.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published...

CVE-2026-16484

SourceCodester Class and Exam Timetabling System 1.0 is affected by a SQL injection in the /edit_subjecta.php parameter ID. The vulnerability arises from manipulating the ID argument, enabling remote exploitation. The exploit has been published and may be used. CVSS metrics in the entry indicate ...

CVE-2026-63080

Aptabase through commit 5a89368 contains a SQL injection vulnerability in the ClickHouse query backend that allows authenticated attackers to read event data across all tenants by injecting unsanitized filter parameters into Liquid SQL templates. Attackers can supply malicious values through...

CVE-2026-52469

SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the DeviceInfoMapper.xml file...

CVE-2026-63080

Aptabase (through commit 5a89368) contains a SQL injection vulnerability in the ClickHouse query backend that allows authenticated attackers to read event data across all tenants by injecting unsanitized filter parameters into Liquid SQL templates. The attack can be carried out by supplying malic...

CVE-2016-20096

Linknat VOS3000 and VOS2009 through version 2.1.2.0 contain an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands by manipulating the name parameter in a POST request to the login endpoint. Attackers can inject malicious SQL through the logi...

CVE-2026-55084 SQL Injection in SqlView Filter Parameter Leading to Arbitrary Database Read

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. A SQL injection vulnerability was identified in the SqlView API endpoint of the DHIS2 application in the filter parameter used by the /api/sqlViews/viewId/data.json endpoint. An...

CVE-2026-55084

DHIS2 has a SQL injection vulnerability in the SqlView filter parameter of the /api/sqlViews/{viewId}/data.json endpoint. An authenticated SqlView user can inject arbitrary SQL through the filter, with output reflected in an error message, enabling error-based SQL extraction of database content. ...

Exploit for SQL Injection in Tenable Nessus

CVE-2026-57588---Nessus-XML-Import-SQL-Injection-PoC PoC for C...

CVE-2026-64877

An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database...

CVE-2026-64877

An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database...

CVE-2026-64877

CVE-2026-64877 is an authenticated, non-admin SQL injection vulnerability in the appliance’s ticketing REST API that can lead to access to sensitive data stored in the appliance database. The CVSS v3.1 base score is 9.6 (CRITICAL) with network attack vector, low attack complexity, and privileges ...