PT-2026-118325

UNSUPPORTED WHEN ASSIGNED Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. Missing input sanitation would allow arbitrary SQL injection through the SQL processor or sql:/esql:...

PT-2026-118286

A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the system...

PT-2026-118314

A weakness has been identified in Osclass up to 8.3.1. Affected by this vulnerability is the function Item::findUserItems of the file oc-includes/osclass/model/Item.php of the component Item Model Handler. This manipulation of the argument sPattern causes sql injection. The attack may be initiate...

PT-2026-118310

The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters of the LIKE operator are escaped, quote characters are not. A crafted search term can therefore leave the intended string value and change the database query...

PT-2026-118315

Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker could use this to inject HTML into an email that is shown to the recipient...

PT-2026-118298

Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query in github.com/sipcapture/homer-app. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

Linux Distros Unpatched Vulnerability : CVE-2026-112307

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows attackers to inject PHP expressions by supplying SQL text containing unescaped...

PT-2026-118313

A security flaw has been discovered in mcollina mcp-ripgrep up to 0.4.0. Affected is an unknown function of the file src/index.ts of the component Advanced Search Tool. The manipulation of the argument fileType results in os command injection. The attack requires a local approach. The exploit has...

PT-2026-118590

Wavlink WL-WN530BE1-A firmware through M30BE1 V251117 contains an OS command injection vulnerability in the sub 23B54 function of the ioos binary, which passes the unsanitized file id parameter of /protocol.csp?opt=ovpn file requests with type=del to popen. A remote unauthenticated attacker can...

Security Vulnerabilities fixed in Thunderbird 153.5.1 — Mozilla

When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password. Thunderbird did n...

PT-2026-118507

Name of the Vulnerable Software and Affected Versions aaPanel versions prior to 8.25.0 Description An OS command injection issue exists in the File Manager component. The ExecShell function within the class/public/common.py file is susceptible to manipulation via the sfile, dfile, access, and use...

PT-2026-118241

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.6.20 Roundcube Webmail versions 1.7.x prior to 1.7.5 Description Remote authenticated attackers can perform IMAP command injection by injecting CRLF sequences into the uid parameter of the 'mail/headers' a...

PT-2026-118353

A security flaw has been discovered in opensource-socialnetwork up to 9.11/10.1. This affects the function input of the file actions/administrator/cache/dynamic.php of the component Cache Settings. Performing a manipulation of the argument host/port/username/password/type/status results in code...

PT-2026-118340

DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText that passes draft file contents to unserialize without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating...

PT-2026-120152

Name of the Vulnerable Software and Affected Versions Duplicator versions prior to 5.0.0 Duplicator Pro versions prior to 5.0.0 Description An unauthenticated PHP Object Injection exists due to the deserialization of untrusted database content within the unserializeTest function of the DUPX...

VulnCheck KEV: CVE-2023-34545

A SQL injection vulnerability in CSZCMS 1.3.0 allows remote attackers to run arbitrary SQL commands via p parameter or the search URL...

PT-2026-118628

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.9 Description When generating POSIX console scripts, ScriptMakerCustom and pip pass an incompletely quoted interpreter path to the distlib ScriptMaker. If the path contains a space or results in a shebang...

CVE-2024-50972

CVE-2024-50972 Description A SQL injection vulnerability in printtool.php of Itsourcecode Construction Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the borrowid parameter. Vulnerability Type SQL Injection Vendor of Product Itsourcecode Affected Product Code...

CVE-2022-40634

CVE-2022-40634: FreeMarker Server-Side Template Injection in CrafterCMS By inserting malicious content in a FTL template, an attacker may perform SSTI Server-Side Template Injection attacks, which can leverage FreeMarker exposed objects to bypass restrictions and obtain RCE Remote Code Execution...

-CVE-2021-26904

CVE-2021-26904 LMA ISIDA Retriever 5.2 allows SQL Injection Suggested description : "ISIDA RETRIEVER v5.2" SQL Injection Vulnerable functionality : ISIDA RETRIEVER Platform is vulnerable to SQL Injection Vulnerable URL and paramert : website.com/index.php?title=Injection Vulnerable URL and parame...