CVE-2026-19425

Travel Agency Management System developed by Win Men Intermational has a SQL Injection vulnerability. Unauthenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database contents...

CVE-2026-19425

Travel Agency Management System developed by Win Men Intermational has a SQL Injection vulnerability. Unauthenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database contents...

CVE-2026-19425

The CVE-2026-19425 entry concerns the Travel Agency Management System from Win Men Intermational, which has a SQL Injection vulnerability allowing unauthenticated remote attackers to inject arbitrary SQL to read, modify, or delete database contents. The documents do not specify the affected versi...

CVE-2026-19425 Win Men Intermational｜Travel Agency Management System - SQL Injection

Travel Agency Management System developed by Win Men Intermational has a SQL Injection vulnerability. Unauthenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database contents...

CVE-2026-66770

Due to an SQL Injection vulnerability in SAP Social intelligence, an authenticated attacker could directly inject an SQL DDL Data Definition Language string into the underlying database without further authorization. Successful exploitation could allow the attacker to make malicious changes to th...

CVE-2026-58243

SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauthorized database operations against SAP NetWeaver AS ABAP. Successful exploitation could allow the attacker to read sensitive data, modify...

CVE-2026-66770

Technical details about CVE-2026-66770 are not publicly available in the provided documents. Monitor for updates.

EUVD-2026-55882

Due to an SQL Injection vulnerability in SAP Social intelligence, an authenticated attacker could directly inject an SQL DDL Data Definition Language string into the underlying database without further authorization. Successful exploitation could allow the attacker to make malicious changes to th...

EUVD-2026-55873

SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauthorized database operations against SAP NetWeaver AS ABAP. Successful exploitation could allow the attacker to read sensitive data, modify...

CVE-2026-58243 Privilege Escalation vulnerability in SAP ABAP Developer Tools

SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauthorized database operations against SAP NetWeaver AS ABAP. Successful exploitation could allow the attacker to read sensitive data, modify...

CVE-2026-58243

The CVE-2026-58243 entry concerns SAP ABAP Development Tools failing to perform necessary authorization checks for certain functionality, enabling a low-privilege attacker to perform unauthorized database operations on SAP NetWeaver AS ABAP. The issue can lead to reading and modifying sensitive d...

PT-2026-70042

Name of the Vulnerable Software and Affected Versions SAP Social intelligence affected versions not specified Description An authenticated attacker can exploit an SQL Injection flaw to inject SQL DDL Data Definition Language strings directly into the underlying database without additional...

PT-2026-70847

An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that their assigned privileges should not permit. This could result in critical system collections being dropped and recreated without proper...

PT-2026-70125

An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view order parameter. The parameter is concatenated unescaped into a SHOW COLUMNS query via a bare PDO::query call, enabling stacked...

PT-2026-70796

Name of the Vulnerable Software and Affected Versions ishankportfolio versions prior to 1.0.1 Description Contact form submissions may be exposed due to improperly secured client-side database configuration and insufficient access control policies. Applications using publicly exposed database...

PT-2026-70143

Name of the Vulnerable Software and Affected Versions e107 version 2.4.0 Description An SQL injection allows unauthenticated remote attackers to execute arbitrary SQL commands. This occurs because the news item page ID parameter is concatenated directly into a SQL WHERE clause without proper...

PT-2026-70154

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools = label creator permission to execute arbitrary SQL via the image name field of a patron card layout. The image name value is stored verbatim in the layout XML...

PT-2026-70133

Name of the Vulnerable Software and Affected Versions CiviCRM versions prior to 6.18.alpha1 Description An SQL injection issue exists where the contact search RLIKE clause concatenates user-supplied values into a SQL query without proper sanitization. This allows authenticated users with...

PT-2026-70614

Incorrect permission assignment for critical resource in Azure SQL Database allows an authorized attacker to elevate privileges locally...

Metabase 0.63.4 SQL Injection

A proof of concept exploit for an unauthenticated SQL injection vulnerability in Metabase version 0.63.4. The vulnerability allows an attacker-controlled user-id value supplied to the password reset endpoint to reach a HoneySQL query as raw SQL. On installations using the default embedded H2...