CVE-2026-16131

CVE-2026-16131 affects itsourcecode Hospital Management System 1.0. The vulnerability is a SQL injection in the /prescriptionrecord.php file, triggered by the delid parameter. Exploitation is possible remotely, and public exploit access is indicated. The entry provides CVSS metrics (e.g., CVSS 3....

Exploit for CVE-2026-63030

wp2shellscanner !smokehttps://github.com/zi3lak/wp2shell...

Exploit for CVE-2026-60137

CVE-2026-63030 + CVE-2026-60137 - “wp2shell”: unauthenticated...

Exploit for CVE-2026-63030

CVE-2026-63030: wp2shell WordPress Batch API Desynchronizat...

FreeBSD : phpmyfaq -- multiple vulnerabilities (0a0aca9f-8290-11f1-a93b-50ebf6bdf8e9)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 0a0aca9f-8290-11f1-a93b-50ebf6bdf8e9 advisory. phpMyFAQ team reports: An authenticated administrator can supply an untrusted update-package path to th...

Exploit for CVE-2026-63030

wp2shell-poc Proof-of-concept for an unauthenticated SQL inje...

CVE-2026-63030

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the authornotin WPQuery SQL Injection CVE-2026-60137, could allow an attacker to perform SQL Injection and achieve Remote Code Execution...

WordPress Core <= 7.0.1 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by TF1T, dtro, and haongo in WordPress core versions = 7.0.1...

EUVD-2026-45205

An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 104997. The /pa endpoint processes XML content beginning with and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated...

CVE-2026-9586

Sangoma Switchvox SMB Edition 8.3 (104997) is vulnerable to an unauthenticated SQL injection in the /pa endpoint. The endpoint processes XML content beginning with and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. A sing...

CVE-2026-9586 Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB

An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 104997. The /pa endpoint processes XML content beginning with and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated...

EUVD-2026-45201

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc. GisLab Laboratory Management System allows SQL Injection. This issue affects GisLab Laboratory Management System: fr...

CVE-2026-8297 SQLi in GIS Informatics' GisLab Laboratory Management System

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc. GisLab Laboratory Management System allows SQL Injection. This issue affects GisLab Laboratory Management System: fr...

CVE-2026-16014

The CVE-2026-16014 entry concerns code-projects Hospital Bed Management System 1.0. It identifies a vulnerability in an unspecified part of the Login Form, where manipulating the Username argument triggers a SQL injection. The vulnerability enables remote exploitation, and public exploits exist. ...

CVE-2026-16009 itsourcecode Hospital Management System prescriptionorderdetail.php sql injection

A vulnerability was detected in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /prescriptionorderdetail.php. The manipulation of the argument delid results in sql injection. The attack can be launched remotely. The exploit is now public and may be used...

CVE-2026-62238

OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint that constructs PostgreSQL queries by concatenating asset display names into raw SQL. An authenticated attacker with asset creation or rename permissions can inject SQL through...

EUVD-2026-45084

OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint that constructs PostgreSQL queries by concatenating asset display names into raw SQL. An authenticated attacker with asset creation or rename permissions can inject SQL through...

CVE-2026-62238 OpenRemote < 1.26.0 SQL Injection via Crosstab Export

OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint that constructs PostgreSQL queries by concatenating asset display names into raw SQL. An authenticated attacker with asset creation or rename permissions can inject SQL through...

PT-2026-60740

A vulnerability was detected in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /prescriptionorderdetail.php. The manipulation of the argument delid results in sql injection. The attack can be launched remotely. The exploit is now public and may be used...

PT-2026-60855

Name of the Vulnerable Software and Affected Versions WordPress versions 6.8.0 through 6.8.5 WordPress versions 6.9.0 through 6.9.4 WordPress versions 7.0.0 through 7.0.1 Description WordPress Core contains a critical vulnerability chain. The issue stems from the WP Query class failing to properl...