Harness Blind SQL Injection

Harness open source Gitness suffers from a registry related blind SQL injection vulnerability. https://packetstorm.news/download/233045...

PT-2026-99893

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Iron Mountain Archiving Services Inc. EnVision allows SQL Injection. This issue affects enVision: before 260655...

PT-2026-99886

Dayforce Payroll is vulnerable to Time Based-Blind SQL Injection in password recovery functionality. The unauthenticated attacker can prepare GET request with one of the parameters filled in with an arbitrary SQL query. The parameter is interpreted as part of SQL predicate resulting in Time-Based...

CVE-2026-101011: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in aaPanel BaoTa up to 11.8.0. This affects the function getdomainstatus of the file /www/server/panel/mod/project/domain/domainMod.py of the component Domain Handler. The manipulation of the argument get results in sql injection. It is possible to launch the...

PT-2026-99786

Name of the Vulnerable Software and Affected Versions aaPanel BaoTa versions prior to 11.8.1 Description A security flaw in the Domain Handler component allows for remote SQL injection. The issue exists within the get domain status function located in the...

PT-2026-99780

Name of the Vulnerable Software and Affected Versions SPS-Suite WordPress plugin versions prior to 1.4.1 Description An issue exists when the static-page search feature is enabled, where the plugin fails to sanitize the search query before incorporating it into a SQL query. This allows...

PT-2026-102304

Name of the Vulnerable Software and Affected Versions Vehicle Manager Free versions prior to 6.5.8 Description An unauthenticated SQL Injection exists in the site/vehiclemanager.php file. The issue occurs because the order field and order direction parameters are processed through a sanitizing...

PT-2026-99785

Name of the Vulnerable Software and Affected Versions aaPanel BaoTa versions prior to 11.8.1 Description A remote SQL injection is possible through the manipulation of the log type argument within the getData function located in the /www/server/panel/class/data.py file. SQL injection is a techniq...

PT-2026-102301

Name of the Vulnerable Software and Affected Versions Real Estate Manager Free versions prior to 6.7.9 Description An unauthenticated SQL Injection exists in the site/realestatemanager.php endpoint. The issue occurs because the order field parameter is concatenated directly into an unquoted SQL...

CVE-2026-100894: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This issue affects some unknown processing of the file updateguest.php. The manipulation of the argument gname leads to sql injection. The attack may be initiated remotely. Th...

CVE-2026-100899: Improper Neutralization of Special Elements used in an SQL Command

A flaw has been found in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/v2.0.0-beta1. This impacts the function whereRaw of the file app/Filament/Widgets/Timesheet/MonthlyReport.php of the component Timesheet Dashboard. Executing a manipulation of the argument filter can lead to sql...

CVE-2026-100887: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System up to 81bf0b55f5933f3b0dbb1583204a612e06605b95. The impacted element is the function orderby of the file DBquerybuilder.php of the component Database Query Builder. Performing a manipulation of the argumen...

CVE-2026-101108: Improper Neutralization of Special Elements used in an SQL Command

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager Free 6.5.8 - site/vehiclemanager.php reads the orderfield and orderdirection sort parameters at three separate anonymous-reachable frontend entry points category listing, search, and the all-vehicles listing throug...

CVE-2026-100898: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/2.0.0-beta1. This affects the function whereRaw of the file app/Filament/Widgets/Timesheet/ActivitiesReport.php of the component Timesheet Dashboard. Performing a manipulation of the argument filter results in...

CVE-2026-101110: Improper Neutralization of Special Elements used in an SQL Command

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library Free quote instead of rejecting it. The value is then concatenated directly into an unquoted ORDER BY clause, a position where quoting provides no protection at all. Reaching the vulnerable code path requires two...

CVE-2026-101105: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in code-projects Matrimonial System 1.0. The affected element is the function processprofileform of the file /createprofile of the component Profile Creation Endpoint. This manipulation of the argument fname causes sql injection. The attack is possible to be carried...

RHEL 8 : postgresql:12 (RHSA-2026:72363)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:72363 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Arbitrary code executi...

PT-2026-99777

Name of the Vulnerable Software and Affected Versions Post Voting System WordPress plugin version 1.0 Description An issue exists where the software fails to properly sanitize and escape a parameter before incorporating it into a SQL query. This allows authenticated users to execute SQL injection...

CVE-2026-100752: Improper Neutralization of Special Elements used in an SQL Command

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager Free 6.7.9 - site/realestatemanager.php builds the ORDER BY clause of three separate frontend property-listing queries category browsing, search results, and the full property listing from a request-controlled...

PT-2026-102387

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.4 Description Insufficient validation of SQL statements in block query embed blocks executed against siyuan.db allows for the execution of non-read-only SQL statements. An attacker can create malicious .sy document...