CVE-2026-104060 Worklenz < 3.3.0 SQL Injection via Reporting Members Endpoint

Worklenz before 3.3.0 contains an SQL injection vulnerability in the reporting members endpoints that allows authenticated attackers to read arbitrary database contents by injecting SQL through the projects and status parameters. Attackers can send crafted values to POST...

CVE-2026-104060

Worklenz versions prior to 3.3.0 are vulnerable to an SQL injection in the reporting members endpoints. The issue stems from the getTeamMemberInsightData function, where the projects and status parameters are interpolated as unparameterized values into IN clauses . Authenticated attackers can exp...

CVE-2026-69145

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, AOR report generation reloads the value stored in aorfields.field and concatenates it into report SQL without strict field validation. An authenticated user able to...

CVE-2026-69145 SuiteCRM: AOR Reports aor_fields.field SQL Injection

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, AOR report generation reloads the value stored in aorfields.field and concatenates it into report SQL without strict field validation. An authenticated user able to...

CVE-2026-69145

The SuiteCRM application is vulnerable to an SQL Injection in the AOR report generation component prior to versions 7.15.2 and 8.10.2 . The root cause is the application's failure to perform strict field validation when reloading and concatenating the value stored in aor_fields.field into report ...

CVE-2026-122032

SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access to inject arbitrary SQL by submitting a differing where parameter value in the POST body versus the GET query string on the /ecrire/?exec=articles endpoint, bypassing...

Linux Distros Unpatched Vulnerability : CVE-2026-122032

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back- office access to inject arbitrary SQL by submitting a...

CVE-2025-71456

vtenext before 25.02.2 contains an SQL injection vulnerability that allows authenticated low-privileged users to inject SQL by supplying a crafted fieldname parameter to modules/Fax/EditView.php. Attackers can read arbitrary database contents, including password reset tokens stored in...

EUVD-2025-211254

vtenext before 25.02.2 contains an SQL injection vulnerability that allows authenticated low-privileged users to inject SQL by supplying a crafted fieldname parameter to modules/Fax/EditView.php. Attackers can read arbitrary database contents, including password reset tokens stored in...

DEBIAN-CVE-2026-122032

SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access to inject arbitrary SQL by submitting a differing where parameter value in the POST body versus the GET query string on the /ecrire/?exec=articles endpoint, bypassing...

CVE-2026-122032

SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access to inject arbitrary SQL by submitting a differing where parameter value in the POST body versus the GET query string on the /ecrire/?exec=articles endpoint, bypassing...

CVE-2026-121007

A flaw was found in SQL::Abstract. When processing nested statements placed in identifier positions, the library inserts clause values directly into raw database queries rather than parameterizing them as bound values. If an application incorporates untrusted input into these nested queries, an...

CVE-2026-122032 SPIP before 4.4.29 Authenticated SQL Injection via where Parameter

SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access to inject arbitrary SQL by submitting a differing where parameter value in the POST body versus the GET query string on the /ecrire/?exec=articles endpoint, bypassing...

CVE-2026-122032 SPIP before 4.4.29 Authenticated SQL Injection via where Parameter

SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access to inject arbitrary SQL by submitting a differing where parameter value in the POST body versus the GET query string on the /ecrire/?exec=articles endpoint, bypassing...

CVE-2026-122032

SPIP versions prior to 4.4.29 are vulnerable to an Authenticated SQL Injection flaw on the /ecrire/?exec=articles endpoint. The vulnerability is caused by a request parameter mismatch where a differing where parameter value provided in the POST body versus the GET query string allows attackers to...

EUVD-2026-116939

SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access to inject arbitrary SQL by submitting a differing where parameter value in the POST body versus the GET query string on the /ecrire/?exec=articles endpoint, bypassing...

PT-2026-137122

Name of the Vulnerable Software and Affected Versions vtenext versions prior to 25.02.2 Description Authenticated low-privileged users can perform an SQL injection by providing a crafted fieldname parameter to the 'modules/Fax/EditView.php' endpoint. This allows attackers to read arbitrary databa...

PT-2026-136996

SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access to inject arbitrary SQL by submitting a differing where parameter value in the POST body versus the GET query string on the /ecrire/?exec=articles endpoint, bypassing spip sanitiz...

CVE-2026-122032: SPIP: SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access…

SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access to inject arbitrary SQL by submitting a differing where parameter value in the POST body versus the GET query string on the /ecrire/?exec=articles endpoint, bypassing...

UBUNTU-CVE-2026-122032

SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access to inject arbitrary SQL by submitting a differing where parameter value in the POST body versus the GET query string on the /ecrire/?exec=articles endpoint, bypassing...