CVE-2026-77881 Control Web Panel (CWP) < 1.29 Blind SQL Injection via user Parameter

Control Web Panel CWP before webpanelversion 1.29 contains a blind SQL injection vulnerability in an unauthenticated loopback API route that connects to MySQL as root, where the 'user' parameter is interpolated directly into a query against the oauthclients table. Attackers can send crafted...

CVE-2026-77881 Control Web Panel (CWP) < 1.29 Blind SQL Injection via user Parameter

Control Web Panel CWP before webpanelversion 1.29 contains a blind SQL injection vulnerability in an unauthenticated loopback API route that connects to MySQL as root, where the 'user' parameter is interpolated directly into a query against the oauthclients table. Attackers can send crafted...

CVE-2026-77881

Control Web Panel (CWP) versions before webpanel_version 1.30 are vulnerable to a blind SQL injection via a 'user' parameter. The flaw exists in an unauthenticated loopback API route (originally /user_panel_dashboard/, later /valid_token/) where the parameter is directly interpolated into a query...

CVE-2026-77879 Control Web Panel (CWP) < 1.16 SQL Injection via access_token() API

Control Web Panel CWP before webpanelversion 1.16 contains a SQL injection vulnerability in the loopback API authentication gate accesstoken, which connects to MySQL as root and interpolates attacker-controlled values directly into its query. Attackers can inject SQL through the authorizationcode...

EUVD-2026-115246

Control Web Panel CWP before webpanelversion 1.16 contains a SQL injection vulnerability in the loopback API authentication gate accesstoken, which connects to MySQL as root and interpolates attacker-controlled values directly into its query. Attackers can inject SQL through the authorizationcode...

CVE-2026-77879

Control Web Panel (CWP) versions prior to webpanel_version 1.16 are vulnerable to a SQL injection flaw in the access_token() loopback API authentication gate. The root cause is the direct interpolation of attacker-controlled values into MySQL queries, specifically via the authorization_code and c...

CVE-2026-120441

OwnTone Server through 29.3 contains an sql injection vulnerability in mpdstickerfind in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. Attackers can send a crafted 'sticker find song' command to the MPD listener on TCP port 6600 to bypass path...

CVE-2026-120441

OwnTone Server versions through 29.3 are vulnerable to an SQL injection in the mpd_sticker_find() function located in src/mpd.c. Unauthenticated remote attackers can exploit this by sending a crafted 'sticker find song' command to the MPD listener on TCP port 6600 . By injecting SQL via the URI a...

CVE-2026-120441 OwnTone Server through 29.3 SQL Injection via MPD sticker find Command

OwnTone Server through 29.3 contains an sql injection vulnerability in mpdstickerfind in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. Attackers can send a crafted 'sticker find song' command to the MPD listener on TCP port 6600 to bypass path...

CVE-2026-120441 OwnTone Server through 29.3 SQL Injection via MPD sticker find Command

OwnTone Server through 29.3 contains an sql injection vulnerability in mpdstickerfind in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. Attackers can send a crafted 'sticker find song' command to the MPD listener on TCP port 6600 to bypass path...

CVE-2026-120441 OwnTone Server through 29.3 SQL Injection via MPD sticker find Command

OwnTone Server through 29.3 contains an sql injection vulnerability in mpdstickerfind in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. Attackers can send a crafted 'sticker find song' command to the MPD listener on TCP port 6600 to bypass path...

EUVD-2026-115201

OwnTone Server through 29.3 contains an sql injection vulnerability in mpdstickerfind in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. Attackers can send a crafted 'sticker find song' command to the MPD listener on TCP port 6600 to bypass path...

CVE-2026-74993

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Starnet Computer and Network Systems Inventory Tracking Application allows SQL Injection. This issue affects Inventory Tracking Application: through 2026-10-16...

CVE-2026-114364

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Apache Syncope. This CVE covers an incomplete fix for CVE-2026-77051: an administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized...

CVE-2026-74993 SQL Injection in Starnet Computer Systems' Inventory Tracking Application

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Starnet Computer and Network Systems Inventory Tracking Application allows SQL Injection. This issue affects Inventory Tracking Application: through 2026-10-16...

CVE-2026-74993

The Starnet Computer and Network Systems Inventory Tracking Application contains an SQL injection vulnerability due to the improper neutralization of special elements used in an SQL command. This flaw allows an attacker to perform SQL injection attacks against the application. The vulnerability a...

EUVD-2026-115183

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Starnet Computer and Network Systems Inventory Tracking Application allows SQL Injection. This issue affects Inventory Tracking Application: through 2026-10-16...

CVE-2026-74993 SQL Injection in Starnet Computer Systems' Inventory Tracking Application

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Starnet Computer and Network Systems Inventory Tracking Application allows SQL Injection. This issue affects Inventory Tracking Application: through 2026-10-16...

EUVD-2026-115155

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Apache Syncope. This CVE covers an incomplete fix for CVE-2026-77051: an administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized...

CVE-2026-114364

Apache Syncope is vulnerable to SQL injection (CWE-89) due to an incomplete fix for CVE-2026-77051. The root cause is the lack of proper sanitization of opEvent parameters within the Audit Events search functionality. An administrator with adequate entitlements can leverage these unsanitized para...