CVE-2026-109631 Frappe ERPNext before 15.119.1 SQL Injection via Missing Validation

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation, allowing crafted input to alter database queries. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to...

CVE-2026-109631

Frappe ERPNext versions prior to 15.119.1 and 16.32.0 are vulnerable to an SQL injection flaw due to missing input validation in certain endpoints. An authenticated attacker with low privileges can submit specially crafted requests to these endpoints to manipulate database queries and extract sen...

CVE-2026-109626 Frappe ERPNext before 16.34.2 SQL Injection via Multiple Endpoints

Frappe ERPNext before 16.34.2 contains an SQL injection vulnerability caused by missing input validation in multiple endpoints. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the database...

CVE-2026-109626 Frappe ERPNext before 16.34.2 SQL Injection via Multiple Endpoints

Frappe ERPNext before 16.34.2 contains an SQL injection vulnerability caused by missing input validation in multiple endpoints. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the database...

CVE-2026-109626 Frappe ERPNext before 16.34.2 SQL Injection via Multiple Endpoints

Frappe ERPNext before 16.34.2 contains an SQL injection vulnerability caused by missing input validation in multiple endpoints. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the database...

CVE-2026-109626

Frappe ERPNext versions prior to 16.34.2 are vulnerable to an SQL injection flaw due to missing input validation in multiple endpoints. Authenticated attackers with low privileges can exploit this by sending specially crafted requests to trigger the injection and extract sensitive information fro...

CVE-2026-109608 Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoint Input

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in several endpoints that lack input validation. Any authenticated user, including one with no assigned roles, can send specially crafted requests to read other users' sensitive information and escalate...

CVE-2026-109608 Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoint Input

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in several endpoints that lack input validation. Any authenticated user, including one with no assigned roles, can send specially crafted requests to read other users' sensitive information and escalate...

CVE-2026-109609 Frappe ERPNext before 15.119.1 SQL Injection via Missing Input Validation

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the...

CVE-2026-109609 Frappe ERPNext before 15.119.1 SQL Injection via Missing Input Validation

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the...

CVE-2026-109609 Frappe ERPNext before 15.119.1 SQL Injection via Missing Input Validation

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the...

CVE-2026-109608 Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoint Input

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in several endpoints that lack input validation. Any authenticated user, including one with no assigned roles, can send specially crafted requests to read other users' sensitive information and escalate...

CVE-2026-109608

Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 are vulnerable to an SQL injection flaw. The root cause is a lack of input validation across several endpoints, allowing any authenticated user (even those without assigned roles) to submit specially crafted requests. Successful expl...

CVE-2026-109609

Frappe ERPNext versions before 15.119.1 and 16.x before 16.32.0 are vulnerable to an SQL injection flaw. The root cause is a lack of input validation in certain endpoints. An authenticated attacker with low privileges can transmit specially crafted requests to these endpoints to execute arbitrary...

CVE-2026-109573 phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint

phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape, which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB runs in NOBACKSLASHESCAPES mode. Unauthenticated attackers can send a Unicode right single quotation mark in the search...

CVE-2026-109573 phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint

phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape, which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB runs in NOBACKSLASHESCAPES mode. Unauthenticated attackers can send a Unicode right single quotation mark in the search...

CVE-2026-109573

phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape, which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB runs in NOBACKSLASHESCAPES mode. Unauthenticated attackers can send a Unicode right single quotation mark in the search...

CVE-2026-109573

Versions of phpMyFAQ prior to 4.1.9 are vulnerable to an SQL injection via the api/autocomplete search endpoint. The root cause lies in PdoMysql::escape(), which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB operate in NO_BACKSLASH_ESCAPES mode. Unauthent...

CVE-2026-109573 phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint

phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape, which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB runs in NOBACKSLASHESCAPES mode. Unauthenticated attackers can send a Unicode right single quotation mark in the search...

CVE-2026-108928

A security vulnerability has been detected in itsourcecode Online Admission System 1.0. This issue affects some unknown processing of the file /admin/sum.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed...