CVE-2026-108900 Exponent CMS XML-RPC xmlrpc.php userLogin sql injection

A vulnerability has been found in Exponent CMS up to 3.0.2patch2. Affected is the function userLogin of the file xmlrpc.php of the component XML-RPC. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be use...

EUVD-2026-97502

A vulnerability has been found in Exponent CMS up to 3.0.2patch2. Affected is the function userLogin of the file xmlrpc.php of the component XML-RPC. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be use...

CVE-2026-108900

A SQL injection vulnerability exists in Exponent CMS up to version 3.0.2patch2 . The flaw is located within the userLogin function of the xmlrpc.php file in the XML-RPC component. This vulnerability allows for remote execution of unauthorized SQL commands. While the exploit has been disclosed to ...

CVE-2026-109169

LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execute crafted SQL via the firstLetter parameter of TagsDataServlet. Low-privileged attackers can inject UNION SELECT statements returned in the XML tag list to read usernames, emai...

CVE-2026-109169 LogicalDOC Community Edition through 9.3 SQL Injection via tags.xml firstLetter

LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execute crafted SQL via the firstLetter parameter of TagsDataServlet. Low-privileged attackers can inject UNION SELECT statements returned in the XML tag list to read usernames, emai...

EUVD-2026-97448

LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execute crafted SQL via the firstLetter parameter of TagsDataServlet. Low-privileged attackers can inject UNION SELECT statements returned in the XML tag list to read usernames, emai...

CVE-2026-109169 LogicalDOC Community Edition through 9.3 SQL Injection via tags.xml firstLetter

LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execute crafted SQL via the firstLetter parameter of TagsDataServlet. Low-privileged attackers can inject UNION SELECT statements returned in the XML tag list to read usernames, emai...

CVE-2026-109169

LogicalDOC Community Edition versions through 9.3 are vulnerable to a SQL Injection flaw in the TagsDataServlet component. The issue exists in the firstLetter parameter, which fails to properly neutralize input, allowing authenticated users to execute crafted SQL commands. Low-privileged attacker...

CVE-2026-108828

A vulnerability was identified in Zen Cart 2.2.2. Affected by this vulnerability is the function eval of the file admin/configuration.php of the component Admin Panel. The manipulation of the argument gID leads to sql injection. The attack may be initiated remotely. The attack is considered to ha...

CVE-2026-108829

A security flaw has been discovered in Zen Cart up to 2.2.2. Affected by this issue is some unknown functionality of the file admin/modules.php of the component Module Configuration. The manipulation of the argument configuration results in sql injection. The attack may be launched remotely. The...

CVE-2026-108829 Zen Cart Module Configuration modules.php sql injection

A security flaw has been discovered in Zen Cart up to 2.2.2. Affected by this issue is some unknown functionality of the file admin/modules.php of the component Module Configuration. The manipulation of the argument configuration results in sql injection. The attack may be launched remotely. The...

CVE-2026-108829

Zen Cart versions up to 2.2.2 are vulnerable to a remote SQL injection flaw within the Module Configuration component. The vulnerability exists in the admin/modules.php file, where the manipulation of the configuration argument allows for unauthorized database interaction. An exploit has been pub...

EUVD-2026-97352

A security flaw has been discovered in Zen Cart up to 2.2.2. Affected by this issue is some unknown functionality of the file admin/modules.php of the component Module Configuration. The manipulation of the argument configuration results in sql injection. The attack may be launched remotely. The...

CVE-2026-108829 Zen Cart Module Configuration modules.php sql injection

A security flaw has been discovered in Zen Cart up to 2.2.2. Affected by this issue is some unknown functionality of the file admin/modules.php of the component Module Configuration. The manipulation of the argument configuration results in sql injection. The attack may be launched remotely. The...

CVE-2026-105412

An SQL Injection vulnerability affecting Tuleap Enterprise Edition 17.5 could allow an attacker to have read access the Tuleap database...

CVE-2026-108826

A vulnerability was found in Zen Cart up to 2.2.2. This impacts the function zendbperform in the library includes/modules/payment/paypaldp.php of the component PayPal IPN Handler. Performing a manipulation of the argument txnid results in sql injection. The attack can be initiated remotely. The...

CVE-2026-108824

A flaw has been found in DataEase up to 3.0.0. The impacted element is the function Utils.buildCalcField of the file io/dataease/engine/utils/Utils.java. This manipulation of the argument calculated field causes sql injection. It is possible to initiate the attack remotely. The exploit has been...

EUVD-2026-97335

A vulnerability was identified in Zen Cart 2.2.2. Affected by this vulnerability is the function eval of the file admin/configuration.php of the component Admin Panel. The manipulation of the argument gID leads to sql injection. The attack may be initiated remotely. The attack is considered to ha...

CVE-2026-108828

A SQL injection vulnerability exists in Zen Cart 2.2.2 within the Admin Panel component. The flaw resides in the eval function of the admin/configuration.php file, where manipulation of the gID argument allows for remote attack initiation. While the attack is considered to have high complexity an...

CVE-2026-108828 Zen Cart Admin Panel configuration.php eval sql injection

A vulnerability was identified in Zen Cart 2.2.2. Affected by this vulnerability is the function eval of the file admin/configuration.php of the component Admin Panel. The manipulation of the argument gID leads to sql injection. The attack may be initiated remotely. The attack is considered to ha...