SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37982)

Sales and Inventory System is a sales and inventory management enterprise resource planning system developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability, which stems from incorrect handling of parameters in the file/pages/custpostrans.php. Attackers can explo...

PT-2026-91866

Name of the Vulnerable Software and Affected Versions WP Directory Kit WordPress plugin versions prior to 1.5.8 Description Authenticated users with Editor privileges or higher can perform SQL injection attacks. The issue occurs because certain widget settings are not properly sanitized or escape...

CVE-2026-16593: Improper Neutralization of Special Elements used in an SQL Command

The WP Directory Kit WordPress plugin through 1.5.7 does not sanitize and escape some widget settings before using them in a SQL statement, allowing authenticated users with access to the page builder Editor and above to perform SQL injection attacks that execute when the affected page is rendere...

PT-2026-91855

A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. Affected by this vulnerability is an unknown functionality of the file /delete requirement.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The...

PT-2026-92048

Name of the Vulnerable Software and Affected Versions WuzhiCMS versions prior to 4.1.1 Description A SQL injection issue exists in the article::getDataOfJson function within the '/index.php?m=content&f=article&v=getDataOfJson' endpoint. This occurs when the title/master table argument is...

PT-2026-92705

Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM component: Configuration Tools. Supported versions that are affected are 17.0-26.7. Difficult to exploit vulnerability allows low privileged attacker with network access via SQL to compromise Siebel CRM Development. Successf...

SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37981)

Sales and Inventory System is an enterprise resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability, which stems from incorrect handling of the parameter “firstname” in the...

SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37980)

Sales and Inventory System is an enterprise resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability, which stems from the failure of the /pages/sup Edit1.php file to properly validate the ID parameter...

PT-2026-92388

Joomla Extension - j2commerce.com - Unauthenticated blind SQL injection in the storefront product list in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Unauthenticated, blind extraction of arbitrary database content e.g. customer records, order data, stored credentials/tokens via boolean- or...

PT-2026-91856

A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. Affected by this issue is some unknown functionality of the file /update requirement status.php. The manipulation of the argument haydi results in sql injection. It is possible to launch the attack remotely. The...

PT-2026-91869

A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. The impacted element is an unknown function of the file /delete faculty1.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to t...

CVE-2026-90877: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. Affected by this issue is some unknown functionality of the file /updaterequirementstatus.php. The manipulation of the argument haydi results in sql injection. It is possible to launch the attack remotely. The exploi...

PT-2026-91850

A security flaw has been discovered in SourceCodester/katojkalemba Online Food Ordering System 1.0. The impacted element is an unknown function of the file /web/category-foods.php. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The...

PT-2026-92129

In Concrete CMS before 9.5.3, the Document Library block stored the file-set identifiers submitted through fsID without validating them as integers, and when the block was configured with setMode set to any it concatenated each stored identifier directly into the file-set filter query instead of...

SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37978)

Sales and Inventory System is a business resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability, which stems from incorrect handling of the prodcode parameter in the file/pages/proedit1.php. Attackers...

Cisco AsyncOS Email Analysis Arbitrary Command Execution

The vulnerability of the email analysis mechanism of Cisco AsyncOS operating system in Cisco Secure Email protection solutions is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands with roo...

RockyLinux 10 : postgresql18 (RLSA-2026:67280)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:67280 advisory. postgresql: PostgreSQL: SQL injection in pgcreatesubscriber allows arbitrary SQL execution as superuser CVE-2026-6476 postgresql: PostgreSQL: Arbitrary...

CVE-2026-90841 PHPGurukul Blood Donor Management System Report Endpoint Report.php sql injection

A security flaw has been discovered in PHPGurukul Blood Donor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /application/controllers/admin/Report.php of the component Report Endpoint. The manipulation of the argument fromdate/todate results in sql...

CVE-2026-90841 PHPGurukul Blood Donor Management System Report Endpoint Report.php sql injection

A security flaw has been discovered in PHPGurukul Blood Donor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /application/controllers/admin/Report.php of the component Report Endpoint. The manipulation of the argument fromdate/todate results in sql...

CVE-2026-90841

A SQL injection vulnerability in PHPGurukul Blood Donor Management System 1.0 affects the Report Endpoint (file /application/controllers/admin/Report.php). Manipulating the fromdate/todate arguments allows a remote, unauthenticated attacker to inject SQL, potentially compromising confidentiality,...