CVE-2026-63152

Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability that allows authenticated attackers to inject malicious SQL via the idCategoryFilter parameter, which is persisted into the session and later concatenated into a SQL statement without parameterization...

CVE-2026-110083

Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized...

CVE-2026-63165 Omnispace Agora Project < 26.10.0 SQL Injection via sortEvents Parameter

Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject malicious SQL by manipulating the sortEvents parameter, which is concatenated into the ORDER BY clause without sanitization in...

CVE-2026-63165 Omnispace Agora Project < 26.10.0 SQL Injection via sortEvents Parameter

Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject malicious SQL by manipulating the sortEvents parameter, which is concatenated into the ORDER BY clause without sanitization in...

CVE-2026-63165

The Omnispace Agora Project version prior to 26.10.0 is vulnerable to a SQL injection flaw within its calendar functionality. The root cause is the lack of sanitization for the sortEvents parameter, which is directly concatenated into an ORDER BY clause in the app/ModCalendar/CtrlCalendar.php fil...

CVE-2026-63152 Omnispace Agora Project < 26.10.0 Second-Order SQL Injection via _idCategoryFilter

Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability that allows authenticated attackers to inject malicious SQL via the idCategoryFilter parameter, which is persisted into the session and later concatenated into a SQL statement without parameterization...

CVE-2026-63152

The Omnispace Agora Project (versions prior to 26.10.0 ) is vulnerable to a second-order SQL injection in the _idCategoryFilter parameter. Authenticated attackers can inject a malicious payload that is persisted into the session. This payload is subsequently concatenated into a SQL statement with...

CVE-2026-63152 Omnispace Agora Project < 26.10.0 Second-Order SQL Injection via _idCategoryFilter

Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability that allows authenticated attackers to inject malicious SQL via the idCategoryFilter parameter, which is persisted into the session and later concatenated into a SQL statement without parameterization...

CVE-2026-63154

Omnispace Agora Project versions prior to 26.10.0 are vulnerable to a SQL identifier injection vulnerability during the user import flow. The root cause is the use of unvalidated caller-controlled agoraFields[] names as SQL column identifiers. A space administrator can exploit this to escalate pr...

CVE-2026-63154 Omnispace Agora Project < 26.10.0 SQL Identifier Injection via agoraFields[]

Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying caller-controlled agoraFields names as unvalidated SQL column identifiers during the user import flow. Attackers can inject privileged...

CVE-2026-63154 Omnispace Agora Project < 26.10.0 SQL Identifier Injection via agoraFields[]

Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying caller-controlled agoraFields names as unvalidated SQL column identifiers during the user import flow. Attackers can inject privileged...

CVE-2026-110083

Adobe Experience Manager is impacted by an SQL Injection vulnerability (CWE-89 ) caused by the improper neutralization of special elements used in an SQL command. A low-privileged attacker could exploit this issue without user interaction to bypass security measures, potentially gaining unauthori...

CVE-2026-63146

The Omnispace Agora Project (versions prior to 26.10.0 ) is vulnerable to a PHP code injection flaw. The root cause involves unescaped, attacker-controlled values being written into the config.inc.php file via the File::updateConfigFile() and DbInstall::dbControl() functions during installation. ...

CVE-2026-63146

Omnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, attacker-controlled values are written into the config.inc.php configuration file during installation through File::updateConfigFile and DbInstall::dbControl, combined with an SQL injection issue enabl...

CVE-2026-88075

Improper neutralization of special elements used in an sql command 'sql injection' in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network...

CVE-2026-70266

Improper neutralization of special elements used in an sql command 'sql injection' in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network...

CVE-2026-70049

Improper neutralization of special elements used in an sql command 'sql injection' in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over an adjacent network...

CVE-2026-103572

Improper control of generation of code 'code injection' in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attacker to execute code over a network...

EUVD-2026-100146

Improper neutralization of special elements used in an sql command 'sql injection' in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network...

CVE-2026-88075

The Microsoft Configuration Manager is susceptible to an SQL injection vulnerability (CWE-89) due to the improper neutralization of special elements used in an SQL command. An authorized attacker can exploit this flaw over a network to elevate privileges . Microsoft has released updates to addres...