ROS-20261002-73-0148

The vulnerability of the contact search component in the SOGo collaborative work software is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker to execute arbitrary code or gain unauthorized access to protected information...

CVE-2026-85215: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in GG Soft Software Services Inc. Paperwork allows SQL Injection. This issue affects Paperwork: through 2026-09-09...

CVE-2026-104625: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in CodeAstro Simple Loan Management System 1.0. Impacted is an unknown function of the file /admin/index.php. Performing a manipulation of the argument gname results in sql injection. The attack may be initiated remotely. The exploit has been released to the...

CVE-2026-104457: Improper Neutralization of Special Elements used in an SQL Command

YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags action, which wraps unescaped filterN attribute tokens in quotes and concatenates them into a raw tags.value IN ... clause. Unauthenticated attackers on default installs can save filtertags markup in a page with ...

CVE-2026-104609: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This affects the function get of the file editaccounts.php. This manipulation of the argument userid/patientid/physicianid/discountsid/servicesid causes sql injection. Remote...

PT-2026-104175

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows SQL Injection. This issue affects Sef - AI Chatbot Platform: before 2.1. NOTE: The vendor was contacted and it was learned that the product is not...

CVE-2026-80298: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows SQL Injection. This issue affects Sef - AI Chatbot Platform: before 2.1. NOTE: The vendor was contacted and it was learned that the product is not...

PT-2026-104072

A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /reviewer 0/admins/assessments/activities/btn functions.php?action=activity. The manipulation of the argument Title results in sql injection...

PT-2026-104284

A weakness has been identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This affects the function get of the file edit accounts.php. This manipulation of the argument user id/patient id/physician id/discounts id/services id causes sql injection...

PT-2026-104151

The Event Tickets and Registration plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.29.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

PT-2026-104126

Name of the Vulnerable Software and Affected Versions Dc Woocommerce Multi Vendor versions prior to 5.0.19 Description An issue exists where authenticated attackers with vendor-level access or higher specifically those with the edit stores capability can perform SQL Injection. This occurs because...

VulnCheck KEV: CVE-2026-65761

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 - Improper validation of order parameters lead to an unauthenticated SQL injection in easystore, allowing full DB read access including credentials and sessions...

CVE-2026-104613: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in CodeAstro Simple Pharmacy Management System 1.0. This vulnerability affects unknown code of the file /SimplePharmacy-PHP/product/view.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been public...

PT-2026-104346

A security flaw has been discovered in CodeAstro Simple Loan Management System 1.0. Impacted is an unknown function of the file /admin/index.php. Performing a manipulation of the argument g name results in sql injection. The attack may be initiated remotely. The exploit has been released to the...

CVE-2026-82039: Improper Neutralization of Special Elements used in an SQL Command

UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupService.searchQueryBuilder that allows authenticated attackers to inject arbitrary SQL by supplying malicious assetType and groupName values that are inserted unsanitized into a native PostgreSQL query via String.forma...

PT-2026-104267

Name of the Vulnerable Software and Affected Versions YesWiki versions prior to 4.6.7 Description An SQL injection issue exists in the Bazar filtertags action. The system wraps unescaped filterN attribute tokens in quotes and concatenates them into a raw tags.value IN ... clause. Unauthenticated...

Tenable Nessus < 10.12.5 Multiple Vulnerabilities (TNS-2026-26)

According to its self-reported version, the Tenable Nessus application running on the remote host is prior to 10.12.5. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2026-26 advisory. - Nessus did not sufficiently verify the integrity of certain downloaded content...

ServiceNow AI Platform Multiple Vulnerabilities (September 2026 CVE Advisory)

The version of the ServiceNow AI Platform Now Platform running on the remote host is missing the remediations described in the September 2026 CVE Advisory Notification. It is, therefore, affected by multiple vulnerabilities, including the following: - A SQL injection vulnerability that could enab...

PT-2026-104064

Name of the Vulnerable Software and Affected Versions itsourcecode Pet Shop Management System version 1.0 Description A SQL injection issue exists in the admin reject completed.php file. This occurs when the ID argument is manipulated, allowing a remote attacker to execute unauthorized database...

CVE-2026-103766 ClipBucket v5 through 5.5.3-#197 SQL Injection via ads_manager.php delete Parameter

ClipBucket v5 through 5.5.3-197 contains an sql injection vulnerability that allows authenticated users with admanageraccess permission to inject SQL via the delete parameter in adminarea/adsmanager.php. Attackers can supply time-based blind payloads concatenated into AdsManager::DeleteAd queries...