EUVD-2026-87656

Budibase @budibase/server before 3.45.0 builds MySQL and MSSQL column-rename DDL in packages/backend-core/src/sql/sqlTable.ts by interpolating identifiers directly into a raw query string backtick-quoted for MySQL, a single-quoted sprename literal for MSSQL without applying the project's...

CVE-2026-100683 Budibase before 3.45.0 SQL Injection via column-rename DDL

Budibase @budibase/server before 3.45.0 builds MySQL and MSSQL column-rename DDL in packages/backend-core/src/sql/sqlTable.ts by interpolating identifiers directly into a raw query string backtick-quoted for MySQL, a single-quoted sprename literal for MSSQL without applying the project's...

CVE-2026-100683 Budibase before 3.45.0 SQL Injection via column-rename DDL

Budibase @budibase/server before 3.45.0 builds MySQL and MSSQL column-rename DDL in packages/backend-core/src/sql/sqlTable.ts by interpolating identifiers directly into a raw query string backtick-quoted for MySQL, a single-quoted sprename literal for MSSQL without applying the project's...

CVE-2026-100644 SiYuan before v3.8.4 SQL Injection via dailyNoteSavePath

SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the dailyNoteSavePath parameter is concatenated into SQL without escaping. Unauthenticated attackers on published sites with auth disabled can inject SQL via UNION SELECT to extract arbitrary database ro...

CVE-2026-100644

Versions of SiYuan prior to v3.8.4 are vulnerable to a SQL injection vulnerability within the graph query endpoint . The root cause is the improper concatenation of the dailyNoteSavePath parameter into SQL queries without sufficient escaping. This flaw allows unauthenticated attackers targeting p...

EUVD-2026-87738

SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the dailyNoteSavePath parameter is concatenated into SQL without escaping. Unauthenticated attackers on published sites with auth disabled can inject SQL via UNION SELECT to extract arbitrary database ro...

CVE-2026-100644 SiYuan before v3.8.4 SQL Injection via dailyNoteSavePath

SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the dailyNoteSavePath parameter is concatenated into SQL without escaping. Unauthenticated attackers on published sites with auth disabled can inject SQL via UNION SELECT to extract arbitrary database ro...

CVE-2026-100644 SiYuan before v3.8.4 SQL Injection via dailyNoteSavePath

SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the dailyNoteSavePath parameter is concatenated into SQL without escaping. Unauthenticated attackers on published sites with auth disabled can inject SQL via UNION SELECT to extract arbitrary database ro...

CVE-2026-100627 Capgo bundle promotion API channel RBAC deny override bypass

Capgo Cap-go/capgo.app server backend Supabase functions contain an incorrect authorization flaw in the API-key bundle promotion path. The PUT /bundle endpoint, available to "all" and "write" API keys, dispatches to setChannel, which authorizes with checkPermissionc, 'channel.promotebundle', appI...

EUVD-2026-87721

Capgo Cap-go/capgo.app server backend Supabase functions contain an incorrect authorization flaw in the API-key bundle promotion path. The PUT /bundle endpoint, available to "all" and "write" API keys, dispatches to setChannel, which authorizes with checkPermissionc, 'channel.promotebundle', appI...

CVE-2026-100627

The Capgo (Cap-go/capgo.app) server backend Supabase functions contain an incorrect authorization flaw in the API-key bundle promotion path. Specifically, the PUT /bundle endpoint (accessible via "all" and "write" API keys) dispatches to setChannel, which fails to include the channel_id during th...

CVE-2026-100315

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file mydetailsfaculty.php. The manipulation of the argument myfid results in sql injection. The attack can be launched remotely. The explo...

EUVD-2026-87694

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file mydetailsfaculty.php. The manipulation of the argument myfid results in sql injection. The attack can be launched remotely. The explo...

CVE-2026-100315 mathurvishal CloudClassroom-PHP-Project mydetailsfaculty.php sql injection

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file mydetailsfaculty.php. The manipulation of the argument myfid results in sql injection. The attack can be launched remotely. The explo...

CVE-2026-100315 mathurvishal CloudClassroom-PHP-Project mydetailsfaculty.php sql injection

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file mydetailsfaculty.php. The manipulation of the argument myfid results in sql injection. The attack can be launched remotely. The explo...

CVE-2026-100315

A SQL injection vulnerability exists in the mathurvishal CloudClassroom-PHP-Project (up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be). The flaw is located within an unknown function of the mydetailsfaculty.php file, where improper handling of the myfid argument allows for remote exploitatio...

CVE-2026-100314

A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file updatedetailsfromstudent.php. The manipulation of the argument eno leads to sql injection. The attack can be initiated...

CVE-2026-100314 mathurvishal CloudClassroom-PHP-Project updatedetailsfromstudent.php sql injection

A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file updatedetailsfromstudent.php. The manipulation of the argument eno leads to sql injection. The attack can be initiated...

EUVD-2026-87548

A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file updatedetailsfromstudent.php. The manipulation of the argument eno leads to sql injection. The attack can be initiated...

CVE-2026-100314

A security vulnerability has been identified in the mathurvishal CloudClassroom-PHP-Project (specifically in the updatedetailsfromstudent.php file). The issue stems from an unknown function where the manipulation of the eno argument leads to SQL injection . This vulnerability can be exploited rem...