85029 matches found
CVE-2026-72599 e107 e107 - SQL Injection
An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attackers to execute arbitrary SQL via the news item page ID parameter. The parameter is concatenated without escaping into a SQL WHERE clause. An unauthenticated attacker can read, modify, or delete all database contents...
CVE-2026-72562
CVE-2026-72562 affects Pimcore’s admin-ui-classic-bundle (through version 2.3). Affected: DataObject grid id column filter allows an SQL injection because the filter value is concatenated into the SQL WHERE clause without parameterization. Root cause: improper handling of filter input in backend ...
CVE-2026-72562
An SQL injection vulnerability in Pimcore admin-ui-classic-bundle through version 2.3 allows authenticated backend users to execute arbitrary SQL via the DataObject grid id column filter. The filter value is concatenated directly into the SQL WHERE clause without parameterization. An attacker wit...
CVE-2026-72558 CiviCRM CiviCRM - SQL Injection
An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The clause concatenates a user-supplied value into the SQL query without sanitization. An attacker with staff-level access can exfiltrate all...
CVE-2026-72558
CVE-2026-72558 affects CiviCRM up to 6.18.alpha1. An SQL injection exists in the contact search RLIKE clause, where user-supplied input is concatenated into the SQL query, enabling authentication-level staff to read the entire database and exfiltrate data such as donor and member records. The con...
CVE-2026-72558
An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The clause concatenates a user-supplied value into the SQL query without sanitization. An attacker with staff-level access can exfiltrate all...
EUVD-2026-56028
An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The clause concatenates a user-supplied value into the SQL query without sanitization. An attacker with staff-level access can exfiltrate all...
CVE-2026-72550 Friendica Friendica - SQL Injection
An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view order parameter. The parameter is concatenated unescaped into a SHOW COLUMNS query via a bare PDO::query call, enabling stacked...
EUVD-2026-56020
An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view order parameter. The parameter is concatenated unescaped into a SHOW COLUMNS query via a bare PDO::query call, enabling stacked...
CVE-2026-72550
CVE-2026-72550 : In Friendica (through the 2026.08-dev branch) an unauthenticated attacker can cause arbitrary SQL execution via the photo-view order parameter. The parameter is concatenated unescaped into a SHOW COLUMNS query through a bare PDO::query() call, enabling stacked statement injection...
CVE-2026-33921
creationtimestamp| type| source ---|---|--- 2026-08-11 10:56:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/4rrmuvucxjwrg...
WordPress Reviewer plugin <= 3.14.2 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Phat RiO in WordPress Plugin Reviewer versions = 3.14.2...
CVE-2026-6181
creationtimestamp| type| source ---|---|--- 2026-08-11 06:50:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/betvitqikixaz...
CVE-2026-19425
Travel Agency Management System developed by Win Men Intermational has a SQL Injection vulnerability. Unauthenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database contents...
CVE-2026-19425
Travel Agency Management System developed by Win Men Intermational has a SQL Injection vulnerability. Unauthenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database contents...
CVE-2026-19425
The CVE-2026-19425 entry concerns the Travel Agency Management System from Win Men Intermational, which has a SQL Injection vulnerability allowing unauthenticated remote attackers to inject arbitrary SQL to read, modify, or delete database contents. The documents do not specify the affected versi...
CVE-2026-19425 Win Men Intermational｜Travel Agency Management System - SQL Injection
Travel Agency Management System developed by Win Men Intermational has a SQL Injection vulnerability. Unauthenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database contents...
CVE-2026-66770
Due to an SQL Injection vulnerability in SAP Social intelligence, an authenticated attacker could directly inject an SQL DDL Data Definition Language string into the underlying database without further authorization. Successful exploitation could allow the attacker to make malicious changes to th...
CVE-2026-58243
SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauthorized database operations against SAP NetWeaver AS ABAP. Successful exploitation could allow the attacker to read sensitive data, modify...