PT-2026-111676

Name of the Vulnerable Software and Affected Versions SourceCodester Online Exam System version 1.0 Description An issue exists in the Login Endpoint within the file adminpanel/admin/query/loginExe.php. Remote manipulation of the username and pass arguments allows for SQL injection, a technique...

PT-2026-113340

Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject malicious SQL by manipulating the sortEvents parameter, which is concatenated into the ORDER BY clause without sanitization in...

PT-2026-113331

Name of the Vulnerable Software and Affected Versions Omnispace Agora Project versions prior to 26.10.0 Description An authenticated attacker can perform a second-order SQL injection, where malicious input is first stored by the application and later executed in a different context. The issue...

PT-2026-112353

Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint affected versions not specified Description An issue exists where improper neutralization of special elements used in an SQL command leads to SQL injection. This allows an authorized attacker to elevate privileges...

Microsoft SharePoint: CVE-2026-70266: Microsoft Office SharePoint Elevation of Privilege Vulnerability

Improper neutralization of special elements used in an sql command 'sql injection' in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network...

PT-2026-111624

A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this vulnerability is an unknown functionality of the file Admin/getclinic.php of the component AJAX Endpoint. The manipulation of the argument city/cid results i...

PT-2026-111326

Name of the Vulnerable Software and Affected Versions AdithyaYelloju Restaurant-Management-System versions up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c Description An issue exists in the Password Reset component within the file 'User/forgot3.php'. Remote attackers can perform SQL injection, a...

CVE-2026-15399: Improper Neutralization of Special Elements used in an SQL Command

The Animated Number Counters plugin for WordPress is vulnerable to generic SQL Injection via the 'counterid' parameter in all versions up to, and including, 3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2026-108967: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in SourceCodester Performance Indicator System 1.0. Impacted is an unknown function of the file /opils/staff/editcredit.php. The manipulation of the argument credit results in sql injection. The attack may be launched remotely. The exploit has been released to...

CVE-2026-108966: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the file /opils/staff/product.php. The manipulation of the argument Category leads to sql injection. The attack may be initiated remotely. The exploit is publicly...

CVE-2026-108959: Improper Neutralization of Special Elements used in an SQL Command

A security vulnerability has been detected in itsourcecode Online Cake Ordering System 1.0. This impacts an unknown function of the file /addtransacdetail.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit has been...

CVE-2026-108956: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in code-projects Online Reviewer System 1.0. The affected element is an unknown function of the file /reviewer/system/system/admins/manage/users/btnfunctions.php of the component User Update Handler. Such manipulation leads to sql injection. The attack may be launch...

CVE-2026-108964: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/admin/addproduct.php. Performing a manipulation of the argument prodcategory results in sql injection. The attack can be initiated remotely. The exploit has been made publ...

CVE-2026-109115: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects some unknown processing of the file User/forgot3.php of the component Password Reset. Performing a manipulation of the argument email/password results in sql...

CVE-2026-108179: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in PluginUs.Net WOLF bulk-editor allows Blind SQL Injection.This issue affects WOLF: from n/a through 1.1.1...

CVE-2026-63165: Improper Neutralization of Special Elements used in an SQL Command

Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject malicious SQL by manipulating the sortEvents parameter, which is concatenated into the ORDER BY clause without sanitization in...

CVE-2026-55823: Improper Neutralization of Special Elements used in an SQL Command

Frappe is a full-stack web application framework. Prior to 16.23.0, the getcount method in reportview composes a count operation around generated SQL through a raw database execution path, allowing crafted report input to alter SQL executed by the application. This issue is fixed in version 16.23...

CVE-2026-63146: Improper Control of Generation of Code

Omnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, attacker-controlled values are written into the config.inc.php configuration file during installation through File::updateConfigFile and DbInstall::dbControl, combined with an SQL injection issue enabl...

CVE-2026-63152: Improper Neutralization of Special Elements used in an SQL Command

Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability that allows authenticated attackers to inject malicious SQL via the idCategoryFilter parameter, which is persisted into the session and later concatenated into a SQL statement without parameterization...

PT-2026-111623

Name of the Vulnerable Software and Affected Versions girishsaraf Online-Appointment-Booking-System versions up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5 Description An issue exists in the Admin CRUD Endpoint within the file Admin/deleteclinic.php. Manipulation of the cid/did arguments allows f...