PT-2026-111318

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in PluginUs.Net WOLF bulk-editor allows Blind SQL Injection.This issue affects WOLF: from n/a through 1.1.1...

VulnCheck KEV: CVE-2025-14169

The FunnelKit - Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'opid' parameter in all versions up to, and including, 3.13.1.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...

VulnCheck KEV: CVE-2026-3830

The Product Filter for WooCommerce by WBW WordPress plugin before 3.1.3 does not sanitize and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks...

PT-2026-111279

Name of the Vulnerable Software and Affected Versions SourceCodester Performance Indicator System version 1.0 Description Remote SQL injection is possible due to improper processing of the /opils/staff/product.php endpoint. An attacker can exploit this by manipulating the Category variable to...

PT-2026-113327

Name of the Vulnerable Software and Affected Versions Omnispace Agora Project versions prior to 26.10.0 Description A code injection issue exists where unescaped, attacker-controlled values are written into the config.inc.php configuration file during installation via the File::updateConfigFile a...

CVE-2026-23707: Improper Neutralization of Special Elements used in an SQL Command

An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability CWE-89 vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiAnalyzer Cloud...

CVE-2026-109522: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected is an unknown function of the file Admin/deleteclinic.php of the component Admin CRUD Endpoint. The manipulation of the argument cid/did leads to sql injection...

PT-2026-113322

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager affected versions not specified Description An SQL Injection issue exists due to improper neutralization of special elements used in an SQL command. This flaw allows a low-privileged attacker to bypass security feature...

PT-2026-112353

Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint affected versions not specified Description An issue exists where improper neutralization of special elements used in an SQL command leads to SQL injection. This allows an authorized attacker to elevate privileges...

CVE-2026-108179: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in PluginUs.Net WOLF bulk-editor allows Blind SQL Injection.This issue affects WOLF: from n/a through 1.1.1...

PT-2026-111797

Name of the Vulnerable Software and Affected Versions FortiAnalyzer versions 7.6.0 through 7.6.4 FortiAnalyzer versions 7.4.0 through 7.4.7 FortiAnalyzer version 7.2 FortiAnalyzer Cloud versions 7.6.2 through 7.6.4 FortiAnalyzer Cloud versions 7.4.1 through 7.4.7 FortiAnalyzer Cloud versions 7.2....

PT-2026-111676

Name of the Vulnerable Software and Affected Versions SourceCodester Online Exam System version 1.0 Description An issue exists in the Login Endpoint within the file adminpanel/admin/query/loginExe.php. Remote manipulation of the username and pass arguments allows for SQL injection, a technique...

CVE-2026-63316: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability has been identified in Payload CMS. Improper neutralization of input provided by user into "in" and "notin" query paramethers allows an authenticated attacker to perform SQL Injection attacks. This issue was fixed in version 3.90.0 and 4.0.0-canary.34...

Multiple Arbitrary File Read/Write via SQL Injection

An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability CWE-89 in FortiAnalyzer, FortiManager, FortiManager Cloud and FortiAnalyzer Cloud may allow a low privileged user to execute arbitrary commands via crafted requests...

Metabase 0.63.4 SQL Injection

Metabase versions 0.58.0 through 0.63.4 contain an unauthenticated SQL injection vulnerability in the password reset endpoint that can create an administrator session. Included Python proof of concept verifies the condition. https://packetstorm.news/download/235379...

CVE-2026-23706: Improper Neutralization of Special Elements used in an SQL Command

An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability CWE-89 vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2, FortiAnalyzer 7.4.1 through 7.4.6, FortiAnalyzer Cloud 7.6.2, FortiAnalyzer Cloud 7.4.1 through 7.4.6, FortiAnalyzer Cloud 7.2.1...

CVE-2026-109521: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown function of the file changebookingstatus.php. Performing a manipulation of the argument dateselected results in sql injection. The attack may be...

CVE-2026-108964: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/admin/addproduct.php. Performing a manipulation of the argument prodcategory results in sql injection. The attack can be initiated remotely. The exploit has been made publ...

CVE-2026-108956: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in code-projects Online Reviewer System 1.0. The affected element is an unknown function of the file /reviewer/system/system/admins/manage/users/btnfunctions.php of the component User Update Handler. Such manipulation leads to sql injection. The attack may be launch...

CVE-2026-70266: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an sql command 'sql injection' in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network...