Pizzafy 1.0 Shell Upload / SQL Injection

Pizzafy version 1.0 suffers from remote shell upload and remote SQL injection vulnerabilities. Title: pizzafy-1.0-Multiple-SQLi&FU-shell-vulnerabiliries+Exploit Author: nu11secur1ty Date: 10/12/2026 Vendor: https://github.com/clararod9 Software:...

PT-2026-122576

Name of the Vulnerable Software and Affected Versions Nuts versions prior to 1.13 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of gadgets us...

PT-2026-110409

Name of the Vulnerable Software and Affected Versions erzhongxmu JEEWMS versions prior to 2026.09.27-W39 Description A SQL injection flaw exists in the Autocomplete Handler component. A remote attacker can exploit this by manipulating the trem, searchField, or entityName arguments within the...

PT-2026-111052

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.102.0 Frappe ERPNext versions 16.x prior to 16.8.0 Description Missing input validation in certain endpoints allows authenticated attackers with low privileges to perform SQL injection, which is a technique...

Rocky Linux 9.6 [TuxCare] Security Update: mariadb-connector-c / mariadb-connector-c-config / etc (ALMALINUX9.6:CLSA-2026:1791796759)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791796759 advisory. - MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated...

CVE-2026-108794: Improper Neutralization of Special Elements used in an SQL Command

A security vulnerability has been detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this vulnerability is an unknown functionality of the file /base/api/v1.0/systemSettings/dbmigratesetting/ of the component Database Migration Functionality. Such manipulation leads to sql injectio...

VulnCheck KEV: CVE-2026-0702

The VidShop – Shoppable Videos for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'fields' parameter in all versions up to, and including, 1.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

PT-2026-110537

A vulnerability was found in Zen Cart up to 2.2.2. This impacts the function zen db perform in the library includes/modules/payment/paypaldp.php of the component PayPal IPN Handler. Performing a manipulation of the argument txn id results in sql injection. The attack can be initiated remotely. Th...

Metabase 0.63.2 Unauthenticated SQL Injection

Metabase versions through 0.63.2 contain an unauthenticated SQL injection in the password-reset endpoint that can provide administrator access. The supplied proof of concept demonstrates the issue against a lab instance. https://packetstorm.news/download/235216...

CVE-2026-108805: Improper Neutralization of Special Elements used in an SQL Command

A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this vulnerability is the function mysqlquery of the file source/loginprocessing.php of the component Login Handler. This manipulation of the argument email/password causes sq...

PT-2026-122572

Name of the Vulnerable Software and Affected Versions Meals & Wheels versions prior to 1.1.14 Description Unauthenticated attackers can perform PHP Object Injection due to the deserialization of untrusted input. While no POP chain a sequence of gadgets used to achieve code execution is present in...

CVE-2026-108926: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in itsourcecode Baptism Information Management System 1.0. This affects an unknown part of the file ebaptism.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit has been released to the public...

PT-2026-110476

Name of the Vulnerable Software and Affected Versions krupalshah EmployeeRecruitmentSystem versions up to 922ff6d208278282e7c8e36d70d9ae356adec9fe Description A remote SQL injection exists within the Forgot Password Handler component. The issue occurs in the mysql query function located in the...

PT-2026-122570

Name of the Vulnerable Software and Affected Versions Legal Stone versions prior to 1.2.12 Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain a sequence of...

EulerOS 2.0 SP13 : mariadb-connector-c (EulerOS-SA-2026-4071)

According to the versions of the mariadb-connector-c package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validat...

EulerOS 2.0 SP13 : mariadb-connector-c (EulerOS-SA-2026-4162)

According to the versions of the mariadb-connector-c package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validat...

CVE-2026-1907: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection SQLi affects the Kong Gateway Enterprise and Open Source clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane CP, leading to potential unauthorized database access. Leveraging the...

EulerOS 2.0 SP13 : apr-util (EulerOS-SA-2026-4120)

According to the versions of the apr-util packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons,...

CVE-2026-108778

The erzhongxmu JEEWMS software (up to version 2026.09.27-W39) contains a SQL injection vulnerability within the Inbound Quality Check Pda Interface component. Specifically, the WmInQmIController.list function in the file src/main/java/com/zzjee/wm/controller/WmInQmIController.java fails to proper...

CVE-2026-108778 erzhongxmu JEEWMS Inbound Quality Check Pda WmInQmIController.java WmInQmIController.list sql injection

A vulnerability was determined in erzhongxmu JEEWMS up to 2026.09.27-W39. This impacts the function WmInQmIController.list of the file src/main/java/com/zzjee/wm/controller/WmInQmIController.java of the component Inbound Quality Check Pda Interface. This manipulation of the argument searchstr...