EulerOS 2.0 SP11 : apr-util (EulerOS-SA-2026-4211)

According to the versions of the apr-util packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility:...

TencentOS Server 3: php:7.4 (TSSA-2026:1150)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1150 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

EulerOS 2.0 SP13 : apr-util (EulerOS-SA-2026-4029)

According to the versions of the apr-util packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons,...

PT-2026-122585

Name of the Vulnerable Software and Affected Versions Gamic versions prior to 1.20 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of gadgets...

PT-2026-110504

Name of the Vulnerable Software and Affected Versions SEMCMS versions prior to 5.1 Description A flaw in the SEMCMS Banner.php file allows for remote SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution. This occurs within an unknown function of t...

CVE-2026-108807: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. This affects the function mysqlquery of the file source/adminregister.php of the component Registration Handler. Performing a manipulation results in sql injection. The attack may be...

PT-2026-110910

Name of the Vulnerable Software and Affected Versions itsourcecode Online Admission System version 1.0 Description An issue exists in the processing of the /admin/sum.php endpoint. Remote manipulation of the ID argument allows for SQL injection, a technique where malicious SQL statements are...

PT-2026-111076

Frappe ERPNext before 15.113.0 and 16.x before 16.22.0 contains an SQL injection vulnerability caused by missing input validation in some endpoints. Authenticated remote attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive informati...

CVE-2026-108828: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in Zen Cart 2.2.2. Affected by this vulnerability is the function eval of the file admin/configuration.php of the component Admin Panel. The manipulation of the argument gID leads to sql injection. The attack may be initiated remotely. The attack is considered to ha...

CVE-2026-109639: Improper Neutralization of Special Elements used in an SQL Command

Frappe ERPNext before 15.102.0 and 16.x before 16.8.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers with low privileges can send specially crafted requests to the affected endpoints to...

PT-2026-122586

Name of the Vulnerable Software and Affected Versions Good Homes versions prior to 1.3.14 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of...

PT-2026-111062

Frappe ERPNext before 15.102.0 and 16.x before 16.11.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers can send specially crafted requests to the affected endpoints to extract sensitive...

CVE-2026-108826: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in Zen Cart up to 2.2.2. This impacts the function zendbperform in the library includes/modules/payment/paypaldp.php of the component PayPal IPN Handler. Performing a manipulation of the argument txnid results in sql injection. The attack can be initiated remotely. The...

PT-2026-110770

Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 26.9.0 Description An SQL injection issue exists where unprivileged users can execute arbitrary SQL commands. This is achieved by providing an array-valued notification id parameter to the 'notifications.inc.php'...

PT-2026-111025

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the...

EulerOS 2.0 SP11 : apr-util (EulerOS-SA-2026-4302)

According to the versions of the apr-util packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility:...

AlmaLinux 9.6 [TuxCare] Security Update: mariadb-connector-c / mariadb-connector-c-config / etc (ALMALINUX9.6:CLSA-2026:1791796759)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791796759 advisory. - MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated us...

EulerOS 2.0 SP11 : mariadb-connector-c (EulerOS-SA-2026-4254)

According to the versions of the mariadb-connector-c package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validat...

CVE-2026-109353: Improper Neutralization of Special Elements used in an SQL Command

LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued notificationid parameter to notifications.inc.php. Attackers can perform cross-table reads of users.password hashes, with results persisted in...

CVE-2026-108781: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected by this vulnerability is the function WmToMoveGoodsController.list of the file src/main/java/com/zzjee/wm/controller/WmToMoveGoodsController.java of the component PDA Interface. Performing a manipulation of th...