CVE-2022-51021

The NotificationX plugin for WordPress (versions 2.0.0 before 2.3.12) is vulnerable to an unauthenticated SQL injection . An attacker can manipulate database queries by supplying an array-form id parameter to the /wp-json/notificationx/v1/notification/{id} endpoint. Specifically, passing id[1] wi...

CVE-2026-113407

BA-Workflow , developed by YS-infoware , contains a SQL Injection vulnerability (CWE-89). Authenticated remote attackers can exploit this flaw to inject arbitrary SQL statements, potentially allowing them to read, modify, and delete database contents. No specific patch version or remediation step...

CVE-2026-113407 YS-infoware｜BA-Workflow - SQL Injection

BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents...

CVE-2026-113406 YS-infoware｜BA-Workflow - SQL Injection

BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents...

CVE-2026-113406

The BA-Workflow software developed by YS-infoware is vulnerable to a SQL Injection (CWE-89). This flaw allows authenticated remote attackers to inject arbitrary SQL statements, potentially resulting in the unauthorized reading, modification, or deletion of database contents. Specific information ...

CVE-2026-113405 YS-infoware｜BA-Workflow - SQL Injection

BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents...

CVE-2026-113405

The software BA-Workflow , developed by YS-infoware , is vulnerable to a SQL Injection (CWE-89). This flaw allows authenticated remote attackers to execute arbitrary SQL statements, potentially resulting in the ability to read, modify, and delete database contents . No specific affected versions,...

CVE-2026-107081

SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints admin/AJAXlookuphandler.php, admin/AJAXcheckid.php, admin/AJAXvocabolarycontrol.php in SENAYAN Library Management System SLiMS Bulian 9.8.0 allows any authenticated staff user to extrac...

CVE-2026-107081: Undefined Security Weakness

SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints admin/AJAXlookuphandler.php, admin/AJAXcheckid.php, admin/AJAXvocabolarycontrol.php in SENAYAN Library Management System SLiMS Bulian 9.8.0 allows any authenticated staff user to extrac...

CVE-2026-107081

SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints admin/AJAXlookuphandler.php, admin/AJAXcheckid.php, admin/AJAXvocabolarycontrol.php in SENAYAN Library Management System SLiMS Bulian 9.8.0 allows any authenticated staff user to extrac...

EUVD-2026-104452

SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints admin/AJAXlookuphandler.php, admin/AJAXcheckid.php, admin/AJAXvocabolarycontrol.php in SENAYAN Library Management System SLiMS Bulian 9.8.0 allows any authenticated staff user to extrac...

PT-2026-117452

SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints admin/AJAX lookup handler.php, admin/AJAX check id.php, admin/AJAX vocabolary control.php in SENAYAN Library Management System SLiMS Bulian 9.8.0 allows any authenticated staff user to...

CVE-2026-107081

The SENAYAN Library Management System (SLiMS) Bulian 9.8.0 is vulnerable to SQL injection via identifier injection in three admin AJAX endpoints: admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php, and admin/AJAX_vocabolary_control.php. The root cause is the direct interpolation of tableName ...

CVE-2026-112017 JeecgBoot before 3.9.5 SQL Injection via SqlInjectionUtil Newline Bypass

JeecgBoot before 3.9.5 contains an sql injection vulnerability that allows authenticated attackers to bypass the SqlInjectionUtil keyword blocklist by inserting newline characters into dictionary and online report SQL fragments. Attackers can send newline-separated payloads to endpoints like...

CVE-2026-111669

ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the ORDER BY clause by supplying a crafted PagerInfo.Sort query parameter to the shared ToPage paging helper. Attackers holding the system:user:list permission can inject subquery ...

CVE-2026-111669

Versions of ZR.Admin.NET through 3.8.2 are vulnerable to an SQL Injection flaw in the shared ToPage paging helper. An authenticated attacker with system:user:list permissions can manipulate the ORDER BY clause by providing a crafted PagerInfo.Sort query parameter. Specifically, via a GET /system/...

CVE-2026-111669 ZR.Admin.NET through 3.8.2 SQL Injection via PagerInfo.Sort ORDER BY

ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the ORDER BY clause by supplying a crafted PagerInfo.Sort query parameter to the shared ToPage paging helper. Attackers holding the system:user:list permission can inject subquery ...

EUVD-2026-102960

ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the ORDER BY clause by supplying a crafted PagerInfo.Sort query parameter to the shared ToPage paging helper. Attackers holding the system:user:list permission can inject subquery ...

CVE-2026-111669 ZR.Admin.NET through 3.8.2 SQL Injection via PagerInfo.Sort ORDER BY

ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the ORDER BY clause by supplying a crafted PagerInfo.Sort query parameter to the shared ToPage paging helper. Attackers holding the system:user:list permission can inject subquery ...

PT-2026-116068

ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the ORDER BY clause by supplying a crafted PagerInfo.Sort query parameter to the shared ToPage paging helper. Attackers holding the system:user:list permission can inject subquery ...