287953 matches found
PT-2026-102901
The "screenID" parameter in the electronic transaction queue viewer feature within the manual transactions section is susceptible to a time-based blind SQL injection vulnerability...
PT-2026-102712
Name of the Vulnerable Software and Affected Versions Mediawiki - UserPageViewTracker Extension versions prior to 1.46.1 Mediawiki - UserPageViewTracker Extension version 1.45.5 Mediawiki - UserPageViewTracker Extension version 1.43.10 Description An unauthenticated SQL Injection occurs due to...
CVE-2026-68954: Improper Neutralization of Special Elements used in an SQL Command
The "pattern" parameter used in search function in the home page of the TMS application is vulnerable to time-based blind SQL injection vulnerability...
CVE-2026-102491: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was identified in mahonelau kykms up to 8f130c2d85842d5b44caae78cc46d65e505949f7. The impacted element is the function QueryGenerator.doMultiFieldsOrder of the file QueryGenerator.java of the component SqlInjectionUtil. The manipulation of the argument column leads to sql injectio...
PT-2026-102902
The "pattern" parameter used in search function in the home page of the TMS application is vulnerable to time-based blind SQL injection vulnerability...
Linux Distros Unpatched Vulnerability : CVE-2026-53629
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, an attacker with the READ right on logs can craft a URL for the...
PT-2026-102628
ClipBucket v5 through 5.5.3-197 contains a time-based blind SQL injection vulnerability in the language update function where the language id parameter is concatenated unescaped into the WHERE clause of an UPDATE statement. An authenticated administrator with basic settings permission can inject...
CVE-2026-68068: Improper Neutralization of Special Elements used in an SQL Command
The "screenID" parameter in the electronic transaction queue viewer feature within the manual transactions section is susceptible to a time-based blind SQL injection vulnerability...
CVE-2026-79536
bytebase dbhub v1.2.0 was discovered to contain a SQL injection vulnerability in the /utils/sql-parser.ts component. This vulnerability allows attackers to access sensitive databse information via a crafted SQL statement...
VulnCheck KEV: CVE-2023-54400
Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary SQL through the Name parameter of the getEmpByname action without any authentication. Attackers can exploit UNION-based SQL injection...
CVE-2026-79536: Improper Neutralization of Special Elements used in an SQL Command
bytebase dbhub v1.2.0 was discovered to contain a SQL injection vulnerability in the /utils/sql-parser.ts component. This vulnerability allows attackers to access sensitive databse information via a crafted SQL statement...
CVE-2026-102796: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Wikimedia Foundation Mediawiki - UserPageViewTracker Extension allows SQL Injection. This issue affects Mediawiki - UserPageViewTracker Extension: from before 1.46.1, 1.45.5, 1.43.10...
CVE-2015-20122: Improper Neutralization of Special Elements used in an SQL Command
Seeyon A6 collaborative office automation platform contains an unauthenticated SQL injection vulnerability in the attachids parameter of the file attachment download endpoint that allows remote attackers to extract arbitrary database contents without prior authentication. Attackers can inject...
CVE-2026-96429: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the id parameter...
CVE-2026-96430: Exposed Dangerous Method or Function
Exposed Dangerous Method or Function in the /WebAgenda/SQLWin.do API endpoint of Flowring Agentflow 4.0 version Before 2026/08/28 allows remote authenticated users to execute arbitrary SQL commands via the sql parameter...
PT-2026-102465
Exposed Dangerous Method or Function in the /WebAgenda/SQLWin.do API endpoint of Flowring Agentflow 4.0 version Before 2026/08/28 allows remote authenticated users to execute arbitrary SQL commands via the sql parameter...
PT-2026-102464
SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the id parameter...
PT-2026-102623
A vulnerability was identified in mahonelau kykms up to 8f130c2d85842d5b44caae78cc46d65e505949f7. The impacted element is the function QueryGenerator.doMultiFieldsOrder of the file QueryGenerator.java of the component SqlInjectionUtil. The manipulation of the argument column leads to sql injectio...
PT-2026-102627
šØ CVE-2026-102569 ClipBucket v5 through 5.5.3-197 contains a time-based blind SQL injection vulnerability in the admin video edit function where the videoid parameter is concatenated into an UPDATE statement without proper escaping. An authenticated administrator with video moderation permission...