264411 matches found
CVE-2026-115332
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscriptionfilterkeys that bypass keyword-only validation. Attackers can create subscriptions using the malicious key, which is rendered as an unquoted...
CVE-2026-115324
mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vectorstores/databricks.py that allows attackers to inject SQL by influencing stored memory content. Attackers can supply crafted memory text, metadata, or message names that reach unescaped insert and update string...
CVE-2026-115328
JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi in src/serverrealtimeauth/index.js that allows authenticated users to inject SQL via HistoryReadRequest parameters. Attackers can inject stacked statements through NodeId.Id, StartTime, or EndTime values to read, modif...
CVE-2026-112822
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in AmentoTech Workreap Core workreapcore allows Blind SQL Injection.This issue affects Workreap Core: from n/a before 3.4.4...
CVE-2025-71434
Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerability in the /api/doc/out/more/list endpoint via the elementmore parameter with srcType=2. Attackers can inject SQL through docdatefrom/docdateto fields and read results via /api/ec/dev/table/count...
CVE-2022-51023
PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameter. Attackers can send GET requests to /api.php?c=project&f=index with extractvalue payloads in sort to extract database information throug...
CVE-2024-58393
i-Netsolution Readymade Unilevel Ecommerce MLM 2024-03-15 build contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries through the 'id' parameter. Attackers can send GET requests to /product-details.php with boolean-based, stacked, or time-bas...
CVE-2022-51021
NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by supplying an array-form 'id' parameter to /wp-json/notificationx/v1/notification/id. Attackers can pass id1 with crafted SQ...
CVE-2019-25778
SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist array parameter. Attackers can send GET requests to /comment/api/index.php with crafted rlist values using backtick-quoted...
CVE-2019-25778
SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist array parameter. Attackers can send GET requests to /comment/api/index.php with crafted rlist values using backtick-quoted...
CVE-2026-112822 WordPress Workreap Core plugin < 3.4.4 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in AmentoTech Workreap Core workreapcore allows Blind SQL Injection.This issue affects Workreap Core: from n/a before 3.4.4...
EUVD-2026-108137
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in AmentoTech Workreap Core workreapcore allows Blind SQL Injection.This issue affects Workreap Core: from n/a before 3.4.4...
CVE-2026-112822 WordPress Workreap Core plugin < 3.4.4 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in AmentoTech Workreap Core workreapcore allows Blind SQL Injection.This issue affects Workreap Core: from n/a before 3.4.4...
CVE-2026-112822
The AmentoTech Workreap Core WordPress plugin is vulnerable to a Blind SQL Injection flaw due to the improper neutralization of special elements used in SQL commands. This issue affects versions prior to 3.4.4 . An attacker could potentially exploit this to interact with the underlying database. ...
EUVD-2026-108133
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric propertyname or categorical filter values. Attackers can embed SQL in values rendered unescaped into Jinja-generated counter, gauge and rate...
CVE-2026-115332
Lotus versions through 0.10.2 are vulnerable to an SQL injection vulnerability. Authenticated organization users can bypass keyword-only validation by registering crafted subscription_filter_keys . These malicious keys are rendered as unquoted group-by identifiers, allowing attackers to inject SQ...
CVE-2026-115331 Lotus through 0.10.2 SQL Injection via Metric Property Names and Filters
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric propertyname or categorical filter values. Attackers can embed SQL in values rendered unescaped into Jinja-generated counter, gauge and rate...
CVE-2026-115332 Lotus through 0.10.2 SQL Injection via Subscription Filter Keys
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscriptionfilterkeys that bypass keyword-only validation. Attackers can create subscriptions using the malicious key, which is rendered as an unquoted...
CVE-2026-115331 Lotus through 0.10.2 SQL Injection via Metric Property Names and Filters
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric propertyname or categorical filter values. Attackers can embed SQL in values rendered unescaped into Jinja-generated counter, gauge and rate...
CVE-2026-115332 Lotus through 0.10.2 SQL Injection via Subscription Filter Keys
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscriptionfilterkeys that bypass keyword-only validation. Attackers can create subscriptions using the malicious key, which is rendered as an unquoted...