PT-2026-70155

An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the acquisition = order receive permission to read arbitrary database contents via the orderby request parameter in acqui/parcels.pl. The parameter is passed to...

PT-2026-70153

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools = items batchmod permission to read arbitrary database contents by storing a SQL payload in the agefield value of an automatic item modification rule. The...

CVE-2026-63106

ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product listing API where the rating parameter from the products endpoint is concatenated directly into a MySQL HAVING clause without parameterization in ProductController.php. Attackers can perform...

CVE-2026-63106

ReadyEcommerce prior to 4.5.2 exposes an unauthenticated SQL injection in the product listing API: the rating parameter is concatenated into a MySQL HAVING clause in ProductController.php, enabling time-based blind SQL injection to exfiltrate full database contents (including user credentials and...

EUVD-2026-55629

ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product listing API where the rating parameter from the products endpoint is concatenated directly into a MySQL HAVING clause without parameterization in ProductController.php. Attackers can perform...

CVE-2026-63106 ReadyEcommerce < 4.5.2 Unauthenticated SQL Injection via ProductController.php

ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product listing API where the rating parameter from the products endpoint is concatenated directly into a MySQL HAVING clause without parameterization in ProductController.php. Attackers can perform...

CVE-2026-63106

ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product listing API where the rating parameter from the products endpoint is concatenated directly into a MySQL HAVING clause without parameterization in ProductController.php. Attackers can perform...

CVE-2026-63106 ReadyEcommerce < 4.5.2 Unauthenticated SQL Injection via ProductController.php

ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product listing API where the rating parameter from the products endpoint is concatenated directly into a MySQL HAVING clause without parameterization in ProductController.php. Attackers can perform...

CVE-2026-63106: Improper Neutralization of Special Elements used in an SQL Command

ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product listing API where the rating parameter from the products endpoint is concatenated directly into a MySQL HAVING clause without parameterization in ProductController.php. Attackers can perform...

LiteLLM CVE-2026-42208 Blind SQLi Detect

Detects CVE-2026-42208 in BerriAI LiteLLM 1.81.16 = version 1.83.7: failed-auth logging passes the raw Authorization bearer into a virtual-key SQL lookup. Probes POST /v1/chat/completions with x'-prefixed pgsleep payloads never sk- and requires delay scaling plus a fast sk- control to rule out...

LiteLLM Pre-Auth Blind SQLi (CVE-2026-42208)

CVE-2026-42208 in BerriAI LiteLLM 1.81.16 = version 1.83.7: the proxy virtual-key lookup builds SQL with WHERE v.token = 'token' and interpolates the raw bearer from failed auth logging. Inject via Authorization on LLM routes must NOT start with sk-. Calibrates timing, confirms pgsleep scales, th...

SUSE CVE-2026-71287

Cacti's sanitizesqlcolumn lib/functions.php sanitizes user-supplied ORDER BY column names using the regex . Because this allowlist retains letters, digits, underscore, parentheses, and dot intended to support expressions like COUNTid and table.column, a payload such as passes through completely...

WordPress WP Maps CVE-2026-39492 Detect

Detects WP Maps wp-google-map-plugin = 4.9.1 vulnerable to CVE-2026-39492: unauthenticated time-based blind SQLi in wpgmpajaxcall via backtick-wrapped locationid bypassing escsql. Fixed in 4.9.2. !/usr/bin/env python3 -- coding: utf-8 -- """Detect WP Maps CVE-2026-39492 blind SQLi = 4.9.1.""" fro...

CVE-2026-10716

Directus: Authenticated SQL injection in collection creation when using PostgreSQL with PostGIS. A admin can craft a collection with a geometry field where fields[].type starts with geometry but includes attacker-controlled SQL syntax after the geometry subtype, enabling time-based SQL injection....

CVE-2026-71287

Cacti's sanitizesqlcolumn lib/functions.php sanitizes user-supplied ORDER BY column names using the regex . Because this allowlist retains letters, digits, underscore, parentheses, and dot intended to support expressions like COUNTid and table.column, a payload such as passes through completely...

CVE-2026-71288

Koha's guided report builder reports/guidedreports.pl reads the CGI parameter and, for each value, a dynamically-named parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation. Since ORDER BY columns cannot be bound via prepared-statement placeholders,...

CVE-2026-71288

Koha vulnerability CVE-2026-71288 affects the guided report builder (reports/guided_reports.pl). It openly concatenates user-supplied ORDER BY values and corresponding _ovalue parameters into an SQL ORDER BY clause without any allowlist or validation, and appends it to the final query in C4::Repo...

CVE-2026-71288 Koha SQL Injection via order_by and {order}_ovalue Parameters in guided_reports.pl

Koha's guided report builder reports/guidedreports.pl reads the CGI parameter and, for each value, a dynamically-named parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation. Since ORDER BY columns cannot be bound via prepared-statement placeholders,...

CVE-2026-71288 Koha SQL Injection via order_by and {order}_ovalue Parameters in guided_reports.pl

Koha's guided report builder reports/guidedreports.pl reads the CGI parameter and, for each value, a dynamically-named parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation. Since ORDER BY columns cannot be bound via prepared-statement placeholders,...

EUVD-2026-53373

Koha's guided report builder reports/guidedreports.pl reads the orderby CGI parameter and, for each value, a dynamically-named orderovalue parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation: my @orderby = $input-multiparam'orderby'; foreach my...