CVE-2026-109353

LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued notificationid parameter to notifications.inc.php. Attackers can perform cross-table reads of users.password hashes, with results persisted in...

CVE-2026-109353 LibreNMS before 26.9.0 SQL Injection via notification_id in notifications.inc.php

LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued notificationid parameter to notifications.inc.php. Attackers can perform cross-table reads of users.password hashes, with results persisted in...

CVE-2026-109353 LibreNMS before 26.9.0 SQL Injection via notification_id in notifications.inc.php

LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued notificationid parameter to notifications.inc.php. Attackers can perform cross-table reads of users.password hashes, with results persisted in...

CVE-2026-109353

LibreNMS versions before 26.9.0 are vulnerable to an SQL injection flaw within the notifications.inc.php component. This vulnerability allows unprivileged users to inject SQL by supplying an array-valued notification_id parameter . Successful exploitation enables attackers to perform cross-table ...

EUVD-2026-97655

LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued notificationid parameter to notifications.inc.php. Attackers can perform cross-table reads of users.password hashes, with results persisted in...

Siemens RUGGEDCOM CROSSBOW SQL injection vulnerability

Siemens RUGGEDCOM CROSSBOW versions prior to V6.0 have a SQL injection vulnerability. This vulnerability arises from improper validation or cleaning of the input values for the Name and Value fields of custom file tags. This allows attackers with authenticated and administrator privileges to...

Siemens RUGGEDCOM CROSSBOW SQL injection vulnerability

Siemens RUGGEDCOM CROSSBOW versions prior to V6.0 have a SQL injection vulnerability. This vulnerability stems from the improper validation or cleaning of input for device groups or facility names during the Bulk Export workflow. It may allow authenticated attackers with specific privileges to...

Siemens RUGGEDCOM CROSSBOW SQL injection vulnerability

Siemens RUGGEDCOM CROSSBOW versions prior to V6.0 have a SQL injection vulnerability. This vulnerability arises from improper validation or cleaning of inputs during the processing of notification conditions in the Notification Profile configuration. It may allow authenticated attackers with...

Ravi Teja Online-Examination-System Input Verification Error Vulnerability

Ravi Teja Online-Examination-System has a security vulnerability. This vulnerability stems from incorrect handling of the branch parameter in the include/database.php file, which may lead to SQL injection attacks...

Payload CMS SQL injection vulnerability

Payload CMS versions prior to 3.90.0 and 4.0.0-canary.0 through 4.0.0-canary.34 contain an SQL injection vulnerability. This vulnerability stems from improper handling of the “in” and “notin” query parameters provided by users, which may allow authenticated attackers to execute SQL injection...

Siemens RUGGEDCOM CROSSBOW SQL injection vulnerability

Siemens RUGGEDCOM CROSSBOW versions prior to V6.0 have a SQL injection vulnerability. This vulnerability stems from improper validation or cleaning of the filename of the uploaded firmware. It may allow authenticated attackers with specific privileges to execute arbitrary SQL commands on the...

Siemens RUGGEDCOM CROSSBOW SQL injection vulnerability

Siemens RUGGEDCOM CROSSBOW versions prior to V6.0 have a SQL injection vulnerability. This vulnerability arises from improper validation or cleaning of inputs when processing facility names in batch import/export workflows. It may allow authenticated attackers with specific privileges to execute...

WordPress Link Whisper – Free SQL Injection Vulnerability

WordPress Link Whisper Free 0.9.7 and earlier versions have a SQL injection vulnerability. This vulnerability stems from improper handling of special elements in SQL commands, which may lead to blind SQL injections...

CVE-2026-108900

A SQL injection vulnerability exists in Exponent CMS up to version 3.0.2patch2 . The flaw is located within the userLogin function of the xmlrpc.php file in the XML-RPC component. This vulnerability allows for remote execution of unauthorized SQL commands. While the exploit has been disclosed to ...

CVE-2026-108900

A vulnerability has been found in Exponent CMS up to 3.0.2patch2. Affected is the function userLogin of the file xmlrpc.php of the component XML-RPC. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be use...

CVE-2026-108900 Exponent CMS XML-RPC xmlrpc.php userLogin sql injection

A vulnerability has been found in Exponent CMS up to 3.0.2patch2. Affected is the function userLogin of the file xmlrpc.php of the component XML-RPC. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be use...

EUVD-2026-97502

A vulnerability has been found in Exponent CMS up to 3.0.2patch2. Affected is the function userLogin of the file xmlrpc.php of the component XML-RPC. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be use...

CVE-2026-108900 Exponent CMS XML-RPC xmlrpc.php userLogin sql injection

A vulnerability has been found in Exponent CMS up to 3.0.2patch2. Affected is the function userLogin of the file xmlrpc.php of the component XML-RPC. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be use...

CVE-2026-109169

LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execute crafted SQL via the firstLetter parameter of TagsDataServlet. Low-privileged attackers can inject UNION SELECT statements returned in the XML tag list to read usernames, emai...

CVE-2026-109169 LogicalDOC Community Edition through 9.3 SQL Injection via tags.xml firstLetter

LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execute crafted SQL via the firstLetter parameter of TagsDataServlet. Low-privileged attackers can inject UNION SELECT statements returned in the XML tag list to read usernames, emai...