PT-2026-103207

Unauthenticated SQL Injection in Books Gallery = 4.8.3 versions...

PT-2026-103269

A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function db properties of the file functions/DatabaseInc.php of the component Save Data Handler. Such manipulation of the argument values leads to sql injection. The attack can be launched remotely. The...

PT-2026-103536

Name of the Vulnerable Software and Affected Versions Kiteworks Core versions prior to 9.5.0 Description A stored SQL injection exists within an administrative reporting feature. This issue allows an authenticated administrator to read sensitive data from the underlying database and potentially...

PT-2026-103599

Name of the Vulnerable Software and Affected Versions Kiteworks Secure Data Forms affected versions not specified Description An authenticated user can perform a SQL injection by influencing a value derived from their stored account data, which is incorporated into a database query without proper...

PT-2026-103212

Administrator SQL Injection in Category Discount Woocommerce = 5.18 versions...

PT-2026-103331

A vulnerability was determined in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Impacted is the function mysqli query of the file User/ord.php of the component Order Placement. Executing a manipulation of the argument id/name can lead to sql injection...

CVE-2026-102909: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer0/admins/assessments/examproper/btnfunctions.php. The manipulation of the argument accesscode leads to sql injection. The attack can be initiated remotely...

CVE-2026-103113: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in OS4ED openSIS-Classic up to 9.3. The affected element is the function save action of the file modules/students/Student.php of the component General Information Tab. Executing a manipulation of the argument students can lead to sql injection. The attack may be...

PT-2026-103260

Name of the Vulnerable Software and Affected Versions Event Tickets versions prior to 5.29.6 Description An improper neutralization of special elements used in an SQL command allows for Blind SQL Injection. This occurs when the application fails to properly sanitize input, enabling an attacker to...

PT-2026-103018

A vulnerability was identified in SourceCodester Online Leave Management System 1.0. This issue affects some unknown processing of the file /admin/?page=reports. The manipulation of the argument date start/date end leads to sql injection. Remote exploitation of the attack is possible. The exploit...

CVE-2026-103116: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in OS4ED openSIS-Classic up to 9.3. This impacts the function DBQuery of the file functions/GetStuListFnc.php of the component Student List Search Endpoint. This manipulation of the argument LOsort causes sql injection. The attack can be initiated remotely. The...

CVE-2026-102456: Improper Neutralization of Special Elements used in an SQL Command

EasyFlow .NET developed by Digiwin has an SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read database contents...

CVE-2026-6806: Improper Neutralization of Special Elements used in an SQL Command

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'stmlat/stmlng' parameter in all versions up to, and including, 1.4.109 due to insufficient escaping on the user supplied parameter and lack of sufficient...

Iron Mountain enVision 260654 Authenticated SQL Injection

Iron Mountain enVision versions before 260655 contain an authenticated SQL injection vulnerability in the DocumentModule document-listing and detailed-search sorting parameter...

CVE-2026-82307: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Dolusoft Software Technologies SOPLOG allows SQL Injection. This issue affects SOPLOG: before Soplog 2026.9.4.1...

CVE-2026-102908: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. This issue affects some unknown processing of the file /reviewer0/admins/assessments/examproper/questions-view.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to laun...

PT-2026-103009

A vulnerability was identified in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer 0/admins/assessments/examproper/btn functions.php. The manipulation of the argument access code leads to sql injection. The attack can be initiated remotel...

PT-2026-103293

Name of the Vulnerable Software and Affected Versions Trex MES versions prior to 2026-09-29 Description Improper neutralization of special elements used in an SQL command allows for SQL injection, which can lead to Command Line Execution. Recommendations Update Trex MES to a version released afte...

PT-2026-102968

Zetetic SQLCipher before 4.15.0 allows SQL injection. The sqlcipher export convenience function can be used to copy the contents of one attached database into another. It is most often used to convert between plaintext and encrypted databases. It needs to do dynamic schema manipulation, and thus...

CentOS Linux 8.5 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1779204107)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1779204107 advisory. - In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, the PDO Firebird driver...