CVE-2026-108778: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in erzhongxmu JEEWMS up to 2026.09.27-W39. This impacts the function WmInQmIController.list of the file src/main/java/com/zzjee/wm/controller/WmInQmIController.java of the component Inbound Quality Check Pda Interface. This manipulation of the argument searchstr...

CVE-2026-105412: Improper Neutralization of Special Elements used in an SQL Command

An SQL Injection vulnerability affecting Tuleap Enterprise Edition 17.5 could allow an attacker to have read access the Tuleap database...

CVE-2026-109634: Improper Neutralization of Special Elements used in an SQL Command

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers with high privileges can send specially crafted requests to these endpoints to inject SQL and extract sensitive information fro...

PT-2026-111047

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.121.0 Frappe ERPNext versions 16.x prior to 16.34.0 Description Missing input validation in certain endpoints allows authenticated attackers with high privileges to execute SQL injection. By sending speciall...

CVE-2026-109674: Improper Neutralization of Special Elements used in an SQL Command

Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints caused by missing input validation. Remote authenticated attackers can send specially crafted requests to the affected endpoints to manipulate database queries and extract sensitive...

CVE-2026-108782: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected by this issue is the function CommonServiceImpl.getAutoList of the file src/main/java/org/jeecgframework/core/common/service/impl/CommonServiceImpl.java of the component Autocomplete Handler. Executing a manipulati...

CVE-2026-108928: Improper Neutralization of Special Elements used in an SQL Command

A security vulnerability has been detected in itsourcecode Online Admission System 1.0. This issue affects some unknown processing of the file /admin/sum.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed...

PT-2026-110476

Name of the Vulnerable Software and Affected Versions krupalshah EmployeeRecruitmentSystem versions up to 922ff6d208278282e7c8e36d70d9ae356adec9fe Description A remote SQL injection exists within the Forgot Password Handler component. The issue occurs in the mysql query function located in the...

PT-2026-110433

Name of the Vulnerable Software and Affected Versions ZKTeco BioTime version 9.5.6 Build 20260130.3206 Description An issue in the Database Migration Functionality allows for remote SQL injection. This occurs through the '/base/api/v1.0/systemSettings/db migrate setting/' endpoint. SQL injection ...

PT-2026-110409

Name of the Vulnerable Software and Affected Versions erzhongxmu JEEWMS versions prior to 2026.09.27-W39 Description A SQL injection flaw exists in the Autocomplete Handler component. A remote attacker can exploit this by manipulating the trem, searchField, or entityName arguments within the...

CVE-2026-108814: Improper Neutralization of Special Elements used in an SQL Command

A flaw has been found in SEMCMS up to 5.0. This impacts an unknown function of the file SEMCMSBanner.php. Executing a manipulation can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this...

CVE-2026-108926: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in itsourcecode Baptism Information Management System 1.0. This affects an unknown part of the file ebaptism.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit has been released to the public...

PT-2026-110504

Name of the Vulnerable Software and Affected Versions SEMCMS versions prior to 5.1 Description A flaw in the SEMCMS Banner.php file allows for remote SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution. This occurs within an unknown function of t...

PT-2026-110535

Name of the Vulnerable Software and Affected Versions Tuleap Enterprise Edition version 17.5 Description An SQL Injection flaw allows an attacker to obtain read access to the database. SQL Injection is a technique where malicious SQL statements are inserted into entry fields for execution,...

PT-2026-110527

A flaw has been found in DataEase up to 3.0.0. The impacted element is the function Utils.buildCalcField of the file io/dataease/engine/utils/Utils.java. This manipulation of the argument calculated field causes sql injection. It is possible to initiate the attack remotely. The exploit has been...

PT-2026-110634

Name of the Vulnerable Software and Affected Versions Exponent CMS versions prior to 3.0.2patch3 Description An issue exists in the XML-RPC component within the userLogin function of the xmlrpc.php file. This flaw allows a remote attacker to perform SQL injection, which is a technique used to...

PT-2026-110513

Name of the Vulnerable Software and Affected Versions Kong Gateway versions prior to 3.9.4 Description A SQL Injection SQLi exists in the clustering communication logic of Kong Gateway Enterprise and Open Source when operating in Hybrid Mode. An attacker can trigger this issue by sending speciall...

CVE-2026-108778 erzhongxmu JEEWMS Inbound Quality Check Pda WmInQmIController.java WmInQmIController.list sql injection

A vulnerability was determined in erzhongxmu JEEWMS up to 2026.09.27-W39. This impacts the function WmInQmIController.list of the file src/main/java/com/zzjee/wm/controller/WmInQmIController.java of the component Inbound Quality Check Pda Interface. This manipulation of the argument searchstr...

CVE-2026-108778

The erzhongxmu JEEWMS software (up to version 2026.09.27-W39) contains a SQL injection vulnerability within the Inbound Quality Check Pda Interface component. Specifically, the WmInQmIController.list function in the file src/main/java/com/zzjee/wm/controller/WmInQmIController.java fails to proper...

CVE-2026-108777 erzhongxmu JEEWMS WvGiController.java WvGiController.list sql injection

A vulnerability was found in erzhongxmu JEEWMS up to 2026.09.27-W39. This affects the function WvGiController.list of the file src/main/java/com/zzjee/wmapi/controller/WvGiController.java. The manipulation of the argument searchstr results in sql injection. The attack can be executed remotely. Th...