CVE-2026-89237: Improper Neutralization of Special Elements used in an SQL Command

The Bluff Post WordPress plugin through 1.1.1 does not sanitise and escape parameters before using them as identifiers in a SQL query, allowing unauthenticated attackers to append additional SQL and extract sensitive information from the database...

CVE-2026-100644: Improper Neutralization of Special Elements used in an SQL Command

SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the dailyNoteSavePath parameter is concatenated into SQL without escaping. Unauthenticated attackers on published sites with auth disabled can inject SQL via UNION SELECT to extract arbitrary database ro...

PT-2026-99256

Name of the Vulnerable Software and Affected Versions CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be Description A remote SQL injection is possible through the manipulation of the gname or editassid arguments within an unknown function of the /updateguest.php...

CVE-2026-100739: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file viewresult.php. Performing a manipulation of the argument seno results in sql injection. Remote exploitation of the attack is...

CVE-2026-100314: Improper Neutralization of Special Elements used in an SQL Command

A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file updatedetailsfromstudent.php. The manipulation of the argument eno leads to sql injection. The attack can be initiated...

CVE-2026-100683: Improper Neutralization of Special Elements used in an SQL Command

Budibase @budibase/server before 3.45.0 builds MySQL and MSSQL column-rename DDL in packages/backend-core/src/sql/sqlTable.ts by interpolating identifiers directly into a raw query string backtick-quoted for MySQL, a single-quoted sprename literal for MSSQL without applying the project's...

PT-2026-99392

Name of the Vulnerable Software and Affected Versions YouTube Gallery versions 1.0.0 through 5.7.2 Description An unauthenticated SQL injection exists in the video search functionality and the router that maps friendly video URLs to database rows. This flaw allows attackers to inject SQL commands...

PT-2026-99435

Name of the Vulnerable Software and Affected Versions mathurvishal CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be Description A SQL injection issue exists in the viewresult.php file. This occurs when the seno argument is manipulated, allowing for remote...

PT-2026-99354

Name of the Vulnerable Software and Affected Versions Budibase @budibase/server versions prior to 3.45.0 Description An issue exists in the way MySQL and MSSQL column-rename DDL is constructed in packages/backend-core/src/sql/sqlTable.ts. The software interpolates identifiers directly into a raw...

CVE-2026-100315: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file mydetailsfaculty.php. The manipulation of the argument myfid results in sql injection. The attack can be launched remotely. The explo...

CVE-2026-53629

GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, an attacker with the READ right on logs can craft a URL for the history tab that injects attacker-controlled values into a database query. This permits SQL injection through the history tab endpoint. Thi...

CVE-2026-53629

GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, an attacker with the READ right on logs can craft a URL for the history tab that injects attacker-controlled values into a database query. This permits SQL injection through the history tab endpoint. Thi...

UBUNTU-CVE-2026-53629

GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, an attacker with the READ right on logs can craft a URL for the history tab that injects attacker-controlled values into a database query. This permits SQL injection through the history tab endpoint. Thi...

CVE-2026-53629 GLPI: SQL injection in history tab

GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, an attacker with the READ right on logs can craft a URL for the history tab that injects attacker-controlled values into a database query. This permits SQL injection through the history tab endpoint. Thi...

CVE-2026-53629 GLPI: SQL injection in history tab

GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, an attacker with the READ right on logs can craft a URL for the history tab that injects attacker-controlled values into a database query. This permits SQL injection through the history tab endpoint. Thi...

CVE-2026-53629

The asset management software GLPI is vulnerable to a blind SQL injection in the history log filter (referred to as LogBleed ) affecting versions from 9.4.0 until 10.0.26 and 11.0.8 . The root cause is located in the Log::convertFiltersValuesToSqlCriteria() function, which fails to properly handl...

EUVD-2026-87289

GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, an attacker with the READ right on logs can craft a URL for the history tab that injects attacker-controlled values into a database query. This permits SQL injection through the history tab endpoint. Thi...

CVE-2026-53629 GLPI: SQL injection in history tab

GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, an attacker with the READ right on logs can craft a URL for the history tab that injects attacker-controlled values into a database query. This permits SQL injection through the history tab endpoint. Thi...

CVE-2026-97884

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file updatestudent.php of the component Student Update Functionality. The manipulation of the argument eno results in sql injection. The...

CVE-2026-97886

A vulnerability has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected by this vulnerability is an unknown functionality of the file managevideos2.php. Such manipulation of the argument editassid leads to sql injection. The attack may be...