CVE-2026-87938 CSP log - Critical - SQL Injection - SA-CONTRIB-2026-136

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Drupal CSP log allows SQL Injection. This issue affects CSP log versions: from 0.0.0 to 1.0.2...

EUVD-2026-107665

A weakness has been identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/update.php. This manipulation of the argument action/fullname/visano/hiden/title/description/pageid/user causes sql injection. The attack may be initiated remotely. T...

EUVD-2026-107574

A vulnerability was determined in itsourcecode Online Cake Ordering System 1.0. The affected element is an unknown function of the file /orderdetail.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly...

EUVD-2026-107667

A vulnerability was identified in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/delete.php. The manipulation of the argument costomerid/ticketid/paymentid/id/documentid/salaryid/empid/userid leads to sql injection. The attack can be initiated remotely. The...

EUVD-2026-107584

A security vulnerability has been detected in itsourcecode Online Cake Ordering System 1.0. Affected is an unknown function of the file /transactionsave.php. Such manipulation of the argument del leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly...

PT-2026-121380

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in AmentoTech Workreap Core workreap core allows Blind SQL Injection.This issue affects Workreap Core: from n/a before 3.4.4...

Progress MOVEit Transfer SQL Injection

Progress MOVEit Transfer contains an unauthenticated SQL injection vulnerability that could allow unauthorized access to database information and exposure of sensitive data...

PT-2026-121368

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only...

PT-2026-122424

mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector stores/databricks.py that allows attackers to inject SQL by influencing stored memory content. Attackers can supply crafted memory text, metadata, or message names that reach unescaped insert and update string...

CVE-2022-51021: Improper Neutralization of Special Elements used in an SQL Command

NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by supplying an array-form 'id' parameter to /wp-json/notificationx/v1/notification/id. Attackers can pass id1 with crafted SQ...

PT-2026-120960

A vulnerability was found in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/insert.php of the component Insertion Handler. The manipulation of the argument costomer id/payment type/amount/description/user/uploadimage/full name/visa no results in sql...

PT-2026-121588

Name of the Vulnerable Software and Affected Versions AOS-8 affected versions not specified Description An unauthenticated remote attacker can perform SQL injection attacks against the affected interface of AOS-8. This flaw could lead to the execution of arbitrary commands on the underlying...

WordPress NotificationX SQL injection vulnerability

WordPress NotificationX versions from 2.0.0 up to 2.3.12 contain an SQL injection vulnerability. This vulnerability stems from improper handling of array-formatted id parameters in /wp-json/notificationx/v1/notification/id. Unauthenticated remote attackers can supply an id containing specially...

PT-2026-121366

JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi in src/server realtime auth/index.js that allows authenticated users to inject SQL via HistoryReadRequest parameters. Attackers can inject stacked statements through NodeId.Id, StartTime, or EndTime values to read,...

CVE-2019-25778: Improper Neutralization of Special Elements used in an SQL Command

SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist array parameter. Attackers can send GET requests to /comment/api/index.php with crafted rlist values using backtick-quoted...

CVE-2024-58393: Improper Neutralization of Special Elements used in an SQL Command

i-Netsolution Readymade Unilevel Ecommerce MLM 2024-03-15 build contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries through the 'id' parameter. Attackers can send GET requests to /product-details.php with boolean-based, stacked, or time-bas...

CVE-2022-51023: Improper Neutralization of Special Elements used in an SQL Command

PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameter. Attackers can send GET requests to /api.php?c=project&f=index with extractvalue payloads in sort to extract database information throug...

PT-2026-121293

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.11...

Weaver E-cology SQL injection vulnerability

Weaver E-cology versions 8.0, 9.0, and 10.0 prior to 10.76 contain an SQL injection vulnerability. This vulnerability allows unauthenticated attackers to perform SQL injection on the /api/doc/out/more/list endpoint via the elementmore parameter srcType=2. They can then inject SQL statements using...

PT-2026-121362

mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector stores/databricks.py that allows attackers to inject SQL by influencing stored memory content. Attackers can supply crafted memory text, metadata, or message names that reach unescaped insert and update string...