PT-2026-97346

Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled identifiers and administrator-supplied values directly into SQL statements. Authenticated Contao backend users with Isotope module permissions can exploit...

CVE-2023-54399: Improper Neutralization of Special Elements used in an SQL Command

Hongjing e-HR before 8.2 contains a SQL injection vulnerability in the /servlet/codesettree endpoint where the categories query parameter is passed to a database query without sanitization after HRMS-encoding is stripped. An unauthenticated remote attacker can supply a crafted UNION SELECT payloa...

CVE-2026-85540: Improper Neutralization of Special Elements used in an SQL Command

DreamMaker developed by Interinfo has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database contents...

CVE-2026-69086: Improper Limitation of a Pathname to a Restricted Directory

SiYuan versions before v3.7.3 fail to validate the avID parameter on all code branches in attribute-view read endpoints, allowing attackers to construct traversal paths that escape the storage directory. Authenticated users with RoleReader permissions or anonymous clients when publish...

CVE-2026-65707 Likeshop 3.0.5 Authenticated SQL Injection via adjustAccount Endpoint

Likeshop through 3.0.5 contains an authenticated SQL injection vulnerability that allows admin-level users to extract arbitrary database contents by submitting unsanitized POST parameters to the adjustAccount endpoint. The adjustAccount method in UserLogic.php concatenates the money, integral,...

CVE-2026-54068

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the /api/icon/getDynamicIcon endpoint is explicitly excluded from authentication in SiYuan's kernel router router.go, "不需要鉴权" -- no auth needed. When called with type=8 and a valid block id parameter, this endpoint...

CVE-2026-8054

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' in the Publish Audit API endpoints /api/auditPublishing/get and /api/auditPublishing/getAll in dotCMS Core 25.11.04-1 through 26.04.28-02 allows remote unauthenticated attackers to read, modify, or destroy arbitrar...

CVE-2026-8054 Unauthenticated SQL Injection in dotCMS Publish Audit API

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' in the Publish Audit API endpoints /api/auditPublishing/get and /api/auditPublishing/getAll in dotCMS Core 25.11.04-1 through 26.04.28-02 allows remote unauthenticated attackers to read, modify, or destroy arbitrar...

CVE-2026-8054: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' in the Publish Audit API endpoints /api/auditPublishing/get and /api/auditPublishing/getAll in dotCMS Core 25.11.04-1 through 26.04.28-02 allows remote unauthenticated attackers to read, modify, or destroy arbitrar...

CVE-2026-48240: Improper Neutralization of Special Elements used in an SQL Command

Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/statistics.php where the tickid and ftickid POST parameters are concatenated into WHERE clauses of SELECT statements in the statistics rollup queries without sanitization. Authenticated attackers can craft requests tha...

Digiwin EasyFlow .NET 安全漏洞

Digiwin EasyFlow .NET is an enterprise-level Workflow Management platform developed by Digiwin in Taiwan, China. There is a security vulnerability in Digiwin EasyFlow .NET, which stems from SQL injection attacks. This vulnerability could allow unverified remote attackers to inject arbitrary SQL...

Flowring Agentflow 安全漏洞

Flowring Agentflow is an intelligent process automation RPA platform developed by Flowring Corporation in China. Flowring Agentflow has a security vulnerability that stems from the lack of authentication. This vulnerability could allow unverified remote attackers to read, modify, and delete...

AMSS++ SQL注入漏洞

AMSS++ is a tool within the Amssplus office management support system. Version 4.31 of AMSS++ has a SQL injection vulnerability. This vulnerability stems from the SQL injection in the id parameter of the modules/mail/main/maildetail.php script, which could allow attackers to access or modify...

CVE-2025-12864: Improper Neutralization of Special Elements used in an SQL Command

U-Office Force developed by e-Excellence has a SQL Injection vulnerability, allowing authenticated remote attacker to inject arbitrary SQL commands to read, modify, and delete database contents...

EUVD-2024-16748

Malicious code in bioql PyPI...

EUVD-2025-27200

Malicious code in bioql PyPI...

EUVD-2023-0917

Malicious code in bioql PyPI...

CVE-2025-40636

SQL injection vulnerability in Joomla module modvvisitcounter v2.0.4j3. This vulnerability allows an attacker to retrieve database content via the ‘cipvvisitcounter’ cookie at all endpoints where the plugin counts visits...

CVE-2025-40636: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Joomla module modvvisitcounter v2.0.4j3. This vulnerability allows an attacker to retrieve database content via the ‘cipvvisitcounter’ cookie at all endpoints where the plugin counts visits...

Gotac Statistical Database System 访问控制错误漏洞

Gotac Statistical Database System is a statistical database system from Gotac Corporation in Taiwan, China. An access control error vulnerability exists in the Gotac Statistical Database System, which stems from a lack of authentication, and could allow an unauthenticated, remote attacker to read...