CVE-2026-18719 cemtan sar2html Search sar2html.py sql injection

A vulnerability was detected in cemtan sar2html 4.0.0. This affects an unknown part of the file sar2html.py of the component Search. Performing a manipulation of the argument Search results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used...

CVE-2026-18719

A vulnerability was detected in cemtan sar2html 4.0.0. This affects an unknown part of the file sar2html.py of the component Search. Performing a manipulation of the argument Search results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the orderBy parameter in the tag statistics endpoint. An attacker can extract sensitive information such as long URLs, visitor records, IP addresses, geolocation data, user agents, and hashed API key secrets by injecti...

Critical: php8.3

Issue Overview: Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9. CVE-2026-17543 Circular symbolic links in phar archives cou...

Critical: php8.2

Issue Overview: Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9. CVE-2026-17543 Circular symbolic links in phar archives cou...

CVE-2026-14872: Improper Neutralization of Special Elements used in an SQL Command

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by users granted a specific capability which is limited to administrators by default...

CVE-2026-64631: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability allowing a low-privileged user to inject SQL and extract database contents...

CVE-2026-70373: Improper Neutralization of Special Elements used in an SQL Command

Koha's reports/issuesstats.pl the circulation statistics report builds its calculation query in sub calculate by concatenating several user-controlled request parameters directly into the SQL string. The PeriodTypeSel, PeriodDaySel, and PeriodMonthSel parameters are interpolated raw into...

CVE-2026-69704: Improper Neutralization of Special Elements used in an SQL Command

Atals-Livre contains a SQL injection vulnerability that allows attackers to manipulate database queries by passing unsanitized input through a GET parameter to the supp deletion helper function. Attackers can inject malicious SQL syntax via the vulnerable GET parameter to perform unauthorized...

Amazon Linux 2023 : php8.2, php8.2-bcmath, php8.2-cli (ALAS2023-2026-2043)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2043 advisory. Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24...

CVE-2026-70370: Improper Neutralization of Special Elements used in an SQL Command

Koha's reports/cataloguestats.pl builds dynamic SQL in sub calculate by interpolating the user-controlled Line and Column request parameters directly into identifier positions of the query SELECT DISTINCTROW, GROUP BY, ORDER BY with no whitelist validation...

CVE-2026-70371: Improper Neutralization of Special Elements used in an SQL Command

Koha's reports/issuesavgstats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Line and Column parameters are not validated against any whitelist and land verbatim in identifier positions SELECT DISTINCTROW, GRO...

Critical: php8.4

Issue Overview: Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9. CVE-2026-17543 Attacker-provided inputs to bccomp could lea...

CVE-2026-70372: Improper Neutralization of Special Elements used in an SQL Command

Koha's reports/borissuestop.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha databa...

PT-2026-67686

Cleartext storage of sensitive information vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows SQL Injection. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

CVE-2026-70369: Improper Neutralization of Special Elements used in an SQL Command

Koha's reports/acquisitionsstats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled Filter request parameters directly into WHERE fragments covering aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.homebranch, items.ccode,...

phpmyfaq -- multiple vulnerabilities

phpMyFAQ team reports: The WebAuthn login flow never persists the challenge it issues, so the replay guard never runs. An attacker who captures a valid assertion can replay it to authenticate as the victim. The brute-force throttle protecting the administration two-factor prompt is scoped to the...

Amazon Linux 2023 : php8.4, php8.4-bcmath, php8.4-cli (ALAS2023-2026-2042)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2042 advisory. Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24...

Amazon Linux 2 : php, --advisory ALAS2PHP8.2-2026-013 (ALASPHP8.2-2026-013)

The version of php installed on the remote host is prior to 8.2.33-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2PHP8.2-2026-013 advisory. Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions...

Amazon Linux 2023 : php8.3, php8.3-bcmath, php8.3-cli (ALAS2023-2026-2044)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2044 advisory. Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24...