CVE-2026-24744: Improper Neutralization of Input During Web Page Generation

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting XSS vulnerability occurs in the Edit Invoices functions of InvoicePlane version 1.7.0. When editing invoices, the application does not validate user input at the...

EUVD-2012-3786

Malware in sbrugna...

CVE-2024-10136

A vulnerability was found in code-projects Pharmacy Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /manageinvoice.php. The manipulation of the argument invoicenumber leads to sql injection. The attack can be initiated remotely. The...

CVE-2024-10136: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in code-projects Pharmacy Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /manageinvoice.php. The manipulation of the argument invoicenumber leads to sql injection. The attack can be initiated remotely. The...

CVE-2024-42561: Improper Neutralization of Special Elements used in an SQL Command

Pharmacy Management System commit a2efc8 was discovered to contain a SQL injection vulnerability via the invoicenumber parameter at salesreport.php...

CVE-2024-42562: Improper Neutralization of Special Elements used in an SQL Command

Pharmacy Management System commit a2efc8 was discovered to contain a SQL injection vulnerability via the invoicenumber parameter at preview.php...

CVE-2024-42561

The Pharmacy Management System (commit a2efc8 ) is vulnerable to a SQL injection flaw. The vulnerability exists in the invoice_number parameter of the sales_report.php endpoint, where improper neutralization of special elements allows for unauthorized database interaction. Practical impact includ...

CVE-2012-3839: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in application/core/MYModel.php in MyClientBase 0.12 allow remote attackers to execute arbitrary SQL commands via the 1 invoicenumber or 2 tags parameter to index.php/invoicesearch...