271762 matches found
CVE-2026-19020: Improper Neutralization of Special Elements used in an SQL Command
A weakness has been identified in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /servicetype.php. This manipulation of the argument editid causes sql injection. It is possible to initiate the attack remotely. The exploit has be...
PT-2026-68832
Name of the Vulnerable Software and Affected Versions Azure SQL Managed Instance affected versions not specified Description Improper restriction of the communication channel to intended endpoints allows an unauthorized attacker to elevate privileges over a network. Recommendations At the moment,...
CVE-2026-19021: Improper Neutralization of Special Elements used in an SQL Command
A security vulnerability has been detected in SourceCodester Computer Repair Shop Management System 1.0. Affected by this issue is some unknown functionality of the file /classes/Master.php?f=deleteproduct. Such manipulation of the argument ID leads to sql injection. It is possible to launch the...
KLA91193 Multiple vulnerabilities in Microsoft Office
Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to execute arbitrary code, gain privileges, spoof user interface. Below is a complete list of vulnerabilities: 1. A remote code execution vulnerability in Azure Service Bus can be exploited...
CVE-2026-67689: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the field and order parameters in paginated list endpoints...
VulnCheck KEV: CVE-2026-72898
Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal store...
EulerOS 2.0 SP13 : proftpd (EulerOS-SA-2026-2988)
According to the versions of the proftpd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In ProFTPD through 1.3.9a before 7666224, a SQL injection vulnerability in sqltabfetchclientscb in contrib/modwrap2sql.c allows a remote attacker ...
CVE-2026-62836: Improper Restriction of Communication Channel to Intended Endpoints
Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-19069: Improper Neutralization of Special Elements used in an SQL Command
A security vulnerability has been detected in itsourcecode Hospital Management System 1.0. This affects an unknown function of the file /treatmentrecord.php. The manipulation of the argument editid leads to sql injection. The attack is possible to be carried out remotely. The exploit has been...
CVE-2026-65546: Improper Neutralization of Special Elements used in an SQL Command
Unauthenticated SQL Injection in Qode Tours = 3.1.3.1 versions...
CVE-2026-12713: Improper Neutralization of Special Elements used in an SQL Command
The WPCargo Track & Trace WordPress plugin before 8.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks. This affects a code path distinct from the one addressed by CVE-2024-44004...
CVE-2026-19062: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in chiuwingyan house up to dea6bcceaebe2b364a5a209747f48ecc2b2dc670. This affects an unknown part of the file /paid/selectall.action. The manipulation of the argument zuname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed...
CVE-2026-65508: Improper Neutralization of Special Elements used in an SQL Command
Unauthenticated SQL Injection in Simply Schedule Appointments = 1.6.12.10 versions...
SUSE SLES15: apache2-mod_php7 / php7 / php7-bcmath / php7-bz2 / php7-calendar / etc (SUSE-SU-2026:3510-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3510-1 advisory. - CVE-2026-7260: Stack overflow in phar with circular symlinks bsc1273077. - CVE-2026-9672: Upgrade libgd bsc1273078. -...
CVE-2026-67689
A SQL Injection vulnerability exists in FineAdmin V1.0 (specifically in FineAdmin.Mvc ) due to improper neutralization of special elements in SQL commands. The BaseService.GetListByFilter() and GetPageUnite() methods directly concatenate the field and order parameters into the ORDER BY clause usi...
Linux Distros Unpatched Vulnerability : CVE-2026-69240
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Sequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if dialect is set to oracle. The escape function defined in...
EulerOS 2.0 SP13 : proftpd (EulerOS-SA-2026-3038)
According to the versions of the proftpd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In ProFTPD through 1.3.9a before 7666224, a SQL injection vulnerability in sqltabfetchclientscb in contrib/modwrap2sql.c allows a remote attacker ...
CVE-2026-66447: Improper Neutralization of Special Elements used in an SQL Command
Unauthenticated SQL Injection in WordPress File Upload = 5.1.7 versions...