CVE-2026-90877: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. Affected by this issue is some unknown functionality of the file /updaterequirementstatus.php. The manipulation of the argument haydi results in sql injection. It is possible to launch the attack remotely. The exploi...

CVE-2026-90855: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in SourceCodester/katojkalemba Online Food Ordering System 1.0. This affects an unknown function of the file /web/order.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been made available to the...

CVE-2026-90854: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in SourceCodester/katojkalemba Online Food Ordering System 1.0. The impacted element is an unknown function of the file /web/category-foods.php. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The...

CVE-2026-90849: Improper Neutralization of Special Elements used in an SQL Command

A security vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /College/login.php. The manipulation of the argument User leads to sql injection. The attack may be initiated remotely...

CVE-2026-90846: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in PHPGurukul Daily Expense Tracker System 1.1. Impacted is an unknown function of the file /dets/forgot-password.php. The manipulation of the argument email/contactno leads to sql injection. The attack is possible to be carried out remotely. The exploit has been...

CVE-2026-90844: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in PHPGurukul Daily Expense Tracker System 1.1. This vulnerability affects unknown code of the file /dets/index.php of the component Login. Performing a manipulation of the argument email results in sql injection. Remote exploitation of the attack is possible. The...

CVE-2026-90841: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in PHPGurukul Blood Donor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /application/controllers/admin/Report.php of the component Report Endpoint. The manipulation of the argument fromdate/todate results in sql...

CVE-2026-79303: Improper Neutralization of Special Elements used in an SQL Command

kaiten from 57.192.20 to before 57.214.26 is vulnerable to SQL Injection. Dynamic SQL statements are generated without the required data validation and without using parameterized statements or stored procedures...

CVE-2026-90879: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in zyx0814 FilePress up to 3.0.1. This vulnerability affects unknown code of the file dzz/publish/search.php of the component Publish Module. Such manipulation of the argument orderby/order leads to sql injection. The attack can be launched remotely. The exploit is...

CVE-2026-91934: Improper Limitation of a Pathname to a Restricted Directory

Flowise versions before 3.1.4 fail to validate file paths in the SQL Database Chain node when connecting to SQLite databases, allowing authenticated attackers to write arbitrary files. Attackers can write malicious SQLite databases to system directories or inject files into the web root to execut...

CVE-2026-91848: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in WuzhiCMS up to 4.1.0. Affected by this issue is the function article::getDataOfJson of the file /index.php?m=content&f=article&v=getDataOfJson. The manipulation of the argument title/mastertable leads to sql injection. Remote exploitation of the attack is possibl...

CVE-2026-83210: Improper Neutralization of Special Elements used in an SQL Command

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM component: Server Infrastructure. Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Siebel CRM Deployment. Successful...

CVE-2026-90876: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. Affected by this vulnerability is an unknown functionality of the file /deleterequirement.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The...

PT-2026-91828

A security vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /College/login.php. The manipulation of the argument User leads to sql injection. The attack may be initiated remotely...

PT-2026-92731

Name of the Vulnerable Software and Affected Versions Oracle Siebel CRM versions 17.0 through 26.7 Description A flaw in the Migration component of the Siebel CRM Deployment product allows a low privileged attacker with network access via SQL to compromise the system. Successful exploitation can...

PT-2026-92417

Name of the Vulnerable Software and Affected Versions Netmaker versions prior to 1.5.0 Description An authenticated attacker can perform boolean-based SQL injection when the SQLite database backend is used. The issue occurs because the sqliteDeleteRecord function in the database layer constructs...

EUVD-2026-78816

kaiten from 57.192.20 to before 57.214.26 is vulnerable to SQL Injection. Dynamic SQL statements are generated without the required data validation and without using parameterized statements or stored procedures...

PT-2026-92054

Flowise versions before 3.1.4 fail to validate file paths in the SQL Database Chain node when connecting to SQLite databases, allowing authenticated attackers to write arbitrary files. Attackers can write malicious SQLite databases to system directories or inject files into the web root to execut...

Cisco AsyncOS Email Analysis Arbitrary Command Execution

The vulnerability of the email analysis mechanism of Cisco AsyncOS operating system in Cisco Secure Email protection solutions is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands with roo...

PT-2026-92733

Name of the Vulnerable Software and Affected Versions Oracle Siebel CRM versions 17.0 through 26.7 Description A flaw in the Server Infrastructure component of the Siebel CRM Deployment product allows a low privileged attacker with network access via SQL to compromise the system. Successful...