CVE-2026-108179: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in PluginUs.Net WOLF bulk-editor allows Blind SQL Injection.This issue affects WOLF: from n/a through 1.1.1...

CVE-2026-63165: Improper Neutralization of Special Elements used in an SQL Command

Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject malicious SQL by manipulating the sortEvents parameter, which is concatenated into the ORDER BY clause without sanitization in...

CVE-2026-55823: Improper Neutralization of Special Elements used in an SQL Command

Frappe is a full-stack web application framework. Prior to 16.23.0, the getcount method in reportview composes a count operation around generated SQL through a raw database execution path, allowing crafted report input to alter SQL executed by the application. This issue is fixed in version 16.23...

CVE-2026-63146: Improper Control of Generation of Code

Omnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, attacker-controlled values are written into the config.inc.php configuration file during installation through File::updateConfigFile and DbInstall::dbControl, combined with an SQL injection issue enabl...

CVE-2026-63152: Improper Neutralization of Special Elements used in an SQL Command

Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability that allows authenticated attackers to inject malicious SQL via the idCategoryFilter parameter, which is persisted into the session and later concatenated into a SQL statement without parameterization...

PT-2026-111623

Name of the Vulnerable Software and Affected Versions girishsaraf Online-Appointment-Booking-System versions up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5 Description An issue exists in the Admin CRUD Endpoint within the file Admin/deleteclinic.php. Manipulation of the cid/did arguments allows f...

CVE-2026-89197: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V6.0. Affected devices do not properly validate or sanitize input in the Value field of notification conditions processed during the Notification Profile configuration. This could allow an authenticated attacker with specific...

CVE-2026-89113: Improper Neutralization of Special Elements used in an SQL Command

SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send specially crafted requests to affected functionality to inject arbitrary SQL commands. Successful exploitation could allow the user to...

CVE-2026-89201: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V6.0. Affected devices do not properly validate or sanitize input in device group or facility names processed during the Bulk Export workflow. This could allow an authenticated attacker with specific privileges to execute...

CVE-2026-89200: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V6.0. Affected devices do not properly validate or sanitize input in the Name and Value fields for custom file labels. This could allow an authenticated attacker with administrative privileges to execute arbitrary SQL commands...

PT-2026-113322

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager affected versions not specified Description An SQL Injection issue exists due to improper neutralization of special elements used in an SQL command. This flaw allows a low-privileged attacker to bypass security feature...

CVE-2026-108970: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function MySQLDB::addNewUser of the file include/database.php of the component Registration Form. Performing a manipulation of the argument branch results in s...

CVE-2026-110083: Improper Neutralization of Special Elements used in an SQL Command

Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized...

CVE-2026-70266: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an sql command 'sql injection' in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network...

CVE-2026-109523: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this vulnerability is an unknown functionality of the file Admin/getclinic.php of the component AJAX Endpoint. The manipulation of the argument city/cid results i...

CVE-2026-108965: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/editquantity.php. Executing a manipulation of the argument pqty can lead to sql injection. The attack can be launched remotely. The exploit has been...

PT-2026-113327

Name of the Vulnerable Software and Affected Versions Omnispace Agora Project versions prior to 26.10.0 Description A code injection issue exists where unescaped, attacker-controlled values are written into the config.inc.php configuration file during installation via the File::updateConfigFile a...

CVE-2026-88075: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an sql command 'sql injection' in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network...

CVE-2026-70049: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an sql command 'sql injection' in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over an adjacent network...

Metabase 0.63.4 SQL Injection

Metabase versions 0.58.0 through 0.63.4 contain an unauthenticated SQL injection vulnerability in the password reset endpoint that can create an administrator session. Included Python proof of concept verifies the condition. https://packetstorm.news/download/235379...