CVE-2026-51366

Bottinelli Informatica Vedo Suite v.1.2.5 is affected by a SQL injection vulnerability in the api_vedo/chat endpoint via the utente_chat parameter. A remote, low-privilege attacker can exploit this to achieve arbitrary code execution , resulting in full compromise of confidentiality, integrity, a...

PT-2026-78453

Joomla Extension - cmsjunkie.com - SQL injection in trips search in J-BusinessDirectory 6.2.3 - Search keywords and ORDER BY were concatenated into SQL. 6.2.3 quotes keywords and allow-lists the sort clause...

PT-2026-78266

A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This impacts an unknown function of the file /admin/ajax.php?action=delete menu. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been mad...

PT-2026-78380

Name of the Vulnerable Software and Affected Versions Dell OpenManage Enterprise versions prior to 4.7.0 Description An Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection, allows a low privileged attacker with remote access to potentially cause...

PT-2026-78265

Name of the Vulnerable Software and Affected Versions SourceCodester Simple Online Food Ordering System version 1.0 Description Remote SQL injection is possible through the manipulation of the ID argument in the '/admin/ajax.php?action=save menu' endpoint. SQL injection is a technique where an...

PT-2026-78264

Name of the Vulnerable Software and Affected Versions SourceCodester Simple Online Food Ordering System version 1.0 Description A remote SQL injection flaw exists in the /admin/ajax.php?action=login endpoint. The issue occurs when the Username argument is manipulated, allowing an attacker to...

PT-2026-78387

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.7 Description An issue exists in the glossary create and update endpoints where an escaped string is truncated before being embedded in a SQL literal. Authenticated users with permissions to add or edit the...

PT-2026-78332

Name of the Vulnerable Software and Affected Versions Community by PeepSo versions prior to 9.0.5.3 Description An issue exists that allows for SQL Injection, a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the...

PT-2026-78367

Name of the Vulnerable Software and Affected Versions Zoo versions prior to 4.1.64 Description An unauthenticated SQL injection exists in the element function of the ItemController. The issue occurs because the filter type request value and the type filter array are interpolated into the database...

RHEL 10 : php8.4 (RHSA-2026:56969)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:56969 advisory. PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also...

UBUNTU-CVE-2026-23937

The Zabbix API host.get action can be exploited by authenticated users...

EUVD-2026-62481

SQL Injection vulnerability in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to execute arbitrary code via the apivedo/chat endpoint and the utentechat parameter...

PT-2026-78770

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description Users without admin or power roles can execute arbitrary...

PT-2026-78790

Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0 Description A user with the Automation Engineer role can execute arbitrary Structured Query Language SQL statements against the database. This allows for the creation, reading, updating, or deletion of all...

PT-2026-78490

Name of the Vulnerable Software and Affected Versions Cisco Crosswork affected versions not specified Description Multiple issues exist involving improper neutralization of special elements used in SQL commands, which can lead to SQL injection. SQL injection is a technique where an attacker inser...

PT-2026-78792

Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0 Description A user with the Automation Engineer role can execute arbitrary Structured Query Language SQL statements against the database. This occurs during custom list retrieval within a playbook, enabling...

PT-2026-78373

Name of the Vulnerable Software and Affected Versions FAYDAM Datalogger versions 2.7.1 through 2.7.x Description Improper neutralization of special elements used in an SQL command allows for SQL injection. This occurs when the application fails to properly sanitize user-supplied data before...

CVE-2026-51366

SQL Injection vulnerability in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to execute arbitrary code via the apivedo/chat endpoint and the utentechat parameter...

The vulnerability of the jsonArrayContains() function in the GeoTools library, a software solution for administrative and publishing of geodata on the OSGeo GeoServer server, allows an attacker to disclose protected information and execute arbitrary code.

The vulnerability of the jsonArrayContains function in the GeoTools library, a software solution for administrative and publishing of geodata on the OSGeo GeoServer server, is related to the lack of protective measures for the SQL query structure during the processing of the CQLFILTER parameter...

ALSA-2026:56969 Important: php8.4 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...