CVE-2026-63146: Improper Control of Generation of Code

Omnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, attacker-controlled values are written into the config.inc.php configuration file during installation through File::updateConfigFile and DbInstall::dbControl, combined with an SQL injection issue enabl...

CVE-2026-63152: Improper Neutralization of Special Elements used in an SQL Command

Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability that allows authenticated attackers to inject malicious SQL via the idCategoryFilter parameter, which is persisted into the session and later concatenated into a SQL statement without parameterization...

PT-2026-111623

Name of the Vulnerable Software and Affected Versions girishsaraf Online-Appointment-Booking-System versions up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5 Description An issue exists in the Admin CRUD Endpoint within the file Admin/deleteclinic.php. Manipulation of the cid/did arguments allows f...

CVE-2026-89197: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V6.0. Affected devices do not properly validate or sanitize input in the Value field of notification conditions processed during the Notification Profile configuration. This could allow an authenticated attacker with specific...

CVE-2026-89113: Improper Neutralization of Special Elements used in an SQL Command

SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send specially crafted requests to affected functionality to inject arbitrary SQL commands. Successful exploitation could allow the user to...

CVE-2026-89201: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V6.0. Affected devices do not properly validate or sanitize input in device group or facility names processed during the Bulk Export workflow. This could allow an authenticated attacker with specific privileges to execute...

CVE-2026-89200: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V6.0. Affected devices do not properly validate or sanitize input in the Name and Value fields for custom file labels. This could allow an authenticated attacker with administrative privileges to execute arbitrary SQL commands...

CVE-2026-109620: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in SourceCodester Online Reviewer System 1.0. Affected by this vulnerability is the function PDO::prepare of the file login/index.php. Such manipulation of the argument username/password leads to sql injection. It is possible to launch the attack remotely. The explo...

PT-2026-113322

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager affected versions not specified Description An SQL Injection issue exists due to improper neutralization of special elements used in an SQL command. This flaw allows a low-privileged attacker to bypass security feature...

CVE-2026-108970: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function MySQLDB::addNewUser of the file include/database.php of the component Registration Form. Performing a manipulation of the argument branch results in s...

CVE-2026-110083: Improper Neutralization of Special Elements used in an SQL Command

Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized...

CVE-2026-70266: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an sql command 'sql injection' in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network...

PT-2026-111283

Name of the Vulnerable Software and Affected Versions itsmeravitejak Online-Examination-System versions up to e6208e630b14657999bbfe4c9912302d2a1e2449 Description A remote SQL injection is possible within the Registration Form component. The issue exists in the MySQLDB::addNewUser function locate...

CVE-2026-109523: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this vulnerability is an unknown functionality of the file Admin/getclinic.php of the component AJAX Endpoint. The manipulation of the argument city/cid results i...

VulnCheck KEV: CVE-2025-7402

The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘siteid’ parameter in all versions up to, and including, 4.95 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...

PT-2026-113327

Name of the Vulnerable Software and Affected Versions Omnispace Agora Project versions prior to 26.10.0 Description A code injection issue exists where unescaped, attacker-controlled values are written into the config.inc.php configuration file during installation via the File::updateConfigFile a...

CVE-2026-88075: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an sql command 'sql injection' in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network...

CVE-2026-70049: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an sql command 'sql injection' in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over an adjacent network...

Metabase 0.63.4 SQL Injection

Metabase versions 0.58.0 through 0.63.4 contain an unauthenticated SQL injection vulnerability in the password reset endpoint that can create an administrator session. Included Python proof of concept verifies the condition. https://packetstorm.news/download/235379...

PT-2026-112905

Improper neutralization of special elements used in an sql command 'sql injection' in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network...