CVE-2026-70049: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an sql command 'sql injection' in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over an adjacent network...

CVE-2026-63316: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability has been identified in Payload CMS. Improper neutralization of input provided by user into "in" and "notin" query paramethers allows an authenticated attacker to perform SQL Injection attacks. This issue was fixed in version 3.90.0 and 4.0.0-canary.34...

PT-2026-111318

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in PluginUs.Net WOLF bulk-editor allows Blind SQL Injection.This issue affects WOLF: from n/a through 1.1.1...

PT-2026-111306

The Animated Number Counters plugin for WordPress is vulnerable to generic SQL Injection via the 'counterid' parameter in all versions up to, and including, 3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

Microsoft SharePoint: CVE-2026-70266: Microsoft Office SharePoint Elevation of Privilege Vulnerability

Improper neutralization of special elements used in an sql command 'sql injection' in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network...

PT-2026-111797

Name of the Vulnerable Software and Affected Versions FortiAnalyzer versions 7.6.0 through 7.6.4 FortiAnalyzer versions 7.4.0 through 7.4.7 FortiAnalyzer version 7.2 FortiAnalyzer Cloud versions 7.6.2 through 7.6.4 FortiAnalyzer Cloud versions 7.4.1 through 7.4.7 FortiAnalyzer Cloud versions 7.2....

PT-2026-111676

Name of the Vulnerable Software and Affected Versions SourceCodester Online Exam System version 1.0 Description An issue exists in the Login Endpoint within the file adminpanel/admin/query/loginExe.php. Remote manipulation of the username and pass arguments allows for SQL injection, a technique...

CVE-2026-89201: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V6.0. Affected devices do not properly validate or sanitize input in device group or facility names processed during the Bulk Export workflow. This could allow an authenticated attacker with specific privileges to execute...

CVE-2026-109522: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected is an unknown function of the file Admin/deleteclinic.php of the component Admin CRUD Endpoint. The manipulation of the argument cid/did leads to sql injection...

PT-2026-111281

A weakness has been identified in SourceCodester Performance Indicator System 1.0. The affected element is an unknown function of the file /opils/staff/sales history.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been...

CVE-2026-23707: Improper Neutralization of Special Elements used in an SQL Command

An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability CWE-89 vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiAnalyzer Cloud...

PT-2026-113327

Name of the Vulnerable Software and Affected Versions Omnispace Agora Project versions prior to 26.10.0 Description A code injection issue exists where unescaped, attacker-controlled values are written into the config.inc.php configuration file during installation via the File::updateConfigFile a...

PT-2026-113322

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager affected versions not specified Description An SQL Injection issue exists due to improper neutralization of special elements used in an SQL command. This flaw allows a low-privileged attacker to bypass security feature...

PT-2026-112353

Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint affected versions not specified Description An issue exists where improper neutralization of special elements used in an SQL command leads to SQL injection. This allows an authorized attacker to elevate privileges...

PT-2026-111279

Name of the Vulnerable Software and Affected Versions SourceCodester Performance Indicator System version 1.0 Description Remote SQL injection is possible due to improper processing of the /opils/staff/product.php endpoint. An attacker can exploit this by manipulating the Category variable to...

CVE-2026-108179: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in PluginUs.Net WOLF bulk-editor allows Blind SQL Injection.This issue affects WOLF: from n/a through 1.1.1...

PT-2026-111283

Name of the Vulnerable Software and Affected Versions itsmeravitejak Online-Examination-System versions up to e6208e630b14657999bbfe4c9912302d2a1e2449 Description A remote SQL injection is possible within the Registration Form component. The issue exists in the MySQLDB::addNewUser function locate...

CVE-2026-109115: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects some unknown processing of the file User/forgot3.php of the component Password Reset. Performing a manipulation of the argument email/password results in sql...

Multiple Arbitrary File Read/Write via SQL Injection

An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability CWE-89 in FortiAnalyzer, FortiManager, FortiManager Cloud and FortiAnalyzer Cloud may allow a low privileged user to execute arbitrary commands via crafted requests...

VulnCheck KEV: CVE-2025-14169

The FunnelKit - Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'opid' parameter in all versions up to, and including, 3.13.1.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...