EUVD-2026-88655

SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the words parameter...

CVE-2026-96428 Flowring Agentflow 4.0 - SQL Injection

SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the words parameter...

CVE-2026-96428

A SQL Injection vulnerability exists in the Flowring Agentflow 4.0 software (versions before 2025/08/08 ). The flaw is located in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint, where remote attackers can execute arbitrary SQL commands by manipulating the words parameter. This vulnerability h...

WordPress Books Gallery plugin <= 4.8.3 - SQL Injection vulnerability

SQL Injection vulnerability discovered by sungbyeongchan in WordPress Plugin Books Gallery versions = 4.8.3...

CVE-2026-101878

Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the UserReadBySsoUserOrganizationIdExternalId stored procedure as NVARCHAR50 while the column it queries stores NVARCHAR300, silently truncating the SSO login identifier on SQL Server deployments and allowing a user...

CVE-2026-101878 Bitwarden Server 2025.6.0 < 2025.6.0 Authentication Bypass via SSO Identifier Truncation

Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the UserReadBySsoUserOrganizationIdExternalId stored procedure as NVARCHAR50 while the column it queries stores NVARCHAR300, silently truncating the SSO login identifier on SQL Server deployments and allowing a user...

CVE-2026-101878 Bitwarden Server 2025.6.0 < 2025.6.0 Authentication Bypass via SSO Identifier Truncation

Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the UserReadBySsoUserOrganizationIdExternalId stored procedure as NVARCHAR50 while the column it queries stores NVARCHAR300, silently truncating the SSO login identifier on SQL Server deployments and allowing a user...

CVE-2026-101878

Bitwarden Server versions 2025.6.0 before 2026.5.0 are vulnerable to an authentication bypass on SQL Server deployments. The root cause is an identifier truncation issue where the @ExternalId parameter of the User_ReadBySsoUserOrganizationIdExternalId stored procedure is declared as NVARCHAR(50),...

EUVD-2026-88605

Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the UserReadBySsoUserOrganizationIdExternalId stored procedure as NVARCHAR50 while the column it queries stores NVARCHAR300, silently truncating the SSO login identifier on SQL Server deployments and allowing a user...

CVE-2026-101878 Bitwarden Server 2025.6.0 < 2025.6.0 Authentication Bypass via SSO Identifier Truncation

Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the UserReadBySsoUserOrganizationIdExternalId stored procedure as NVARCHAR50 while the column it queries stores NVARCHAR300, silently truncating the SSO login identifier on SQL Server deployments and allowing a user...

sitesentinel

SiteSentinel A drop-in website security module that partici...

CLEANSTART-2026-XN67293 sqlparse is a non-validating SQL parser module for Python

CVE-2026-54284 affects multiple packages. sqlparse is a non-validating SQL parser module for Python. See references for individual vulnerability details...

CLEANSTART-2026-HH21892 sqlparse is a non-validating SQL parser module for Python

CVE-2026-71491 affects multiple packages. sqlparse is a non-validating SQL parser module for Python. See references for individual vulnerability details...

CLEANSTART-2026-VD54989 sqlparse is a non-validating SQL parser module for Python

CVE-2026-59893 affects multiple packages. sqlparse is a non-validating SQL parser module for Python. See references for individual vulnerability details...

Exploit for CVE-2026-101110

CVE-2026-101110 — OrdaSoft Book Library Free unauthenticated...

EUVD-2026-88559

SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyuan.db. Attackers can craft malicious .sy documents with non-read-only SQL statements that execute automatically during background indexing, rendering, or export operations witho...

Exploit for CVE-2026-101108

CVE-2026-101108 — OrdaSoft Vehicle Manager Free unauthentica...

Exploit for CVE-2026-100752

CVE-2026-100752 — OrdaSoft Real Estate Manager Free unauthen...

PT-2026-102901

The "screenID" parameter in the electronic transaction queue viewer feature within the manual transactions section is susceptible to a time-based blind SQL injection vulnerability...

CVE-2026-72510: Improper Neutralization of Special Elements used in an SQL Command

The "supplierno" parameter used in the business allocation search feature is vulnerable to time-based blind SQL injection...