PT-2026-21136

Name of the Vulnerable Software and Affected Versions TeconceTheme Saasplate Core versions through 1.2.8 Description A flaw exists in TeconceTheme Saasplate Core saasplate-core that allows for Blind SQL Injection due to improper neutralization of special elements used in an SQL command. This issu...

CVE-2026-26745

OpenSourcePOS 3.4.1 has a second order SQL Injection vulnerability in the handling of the currencysymbol configuration field. Although the input is initially stored without immediate execution, it is later concatenated into a dynamically constructed SQL query without proper sanitization or...

Phpscriptsmall – Fiverr Clone Script: SQL Injection Vulnerability

Phpscriptsmall Fiverr Clone Script is a set of software scripts developed by Phpscriptsmall. The Phpscriptsmall Fiverr Clone Script 1.2.2 version contains an SQL injection vulnerability. This vulnerability stems from the page parameter, which allows for SQL injections, potentially enabling...

WordPress plugin JS Help Desk has a security vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

SVXportal security vulnerabilities

SVXportal is a portal website developed by Peter as an individual developer. Versions of SVXportal 2.5 and earlier contained security vulnerabilities. These vulnerabilities stemmed from the lack of validation for the search query parameter in the log.php file, which could lead to reflection-type...

CVE-2026-27502: Improper Neutralization of Input During Web Page Generation

SVXportal version 2.5 and prior contain a reflected cross-site scripting vulnerability in log.php via the search query parameter. The application embeds the unsanitized parameter value directly into an HTML input value attribute, allowing an unauthenticated remote attacker to inject and execute...

CVE-2026-27503: Improper Neutralization of Input During Web Page Generation

SVXportal version 2.5 and prior contain a reflected cross-site scripting vulnerability in admin/log.php via the search query parameter. When an authenticated administrator views a crafted URL, the application embeds the unsanitized parameter value directly into an HTML input value attribute,...

PT-2026-21271

SVXportal version 2.5 and prior contain a reflected cross-site scripting vulnerability in log.php via the search query parameter. The application embeds the unsanitized parameter value directly into an HTML input value attribute, allowing an unauthenticated remote attacker to inject and execute...

Part-DB SQL injection vulnerabilities

Part-DB is an open-source web-based database designed for managing electronic components. Version 0.4 of Part-DB contains a SQL injection vulnerability. This vulnerability stems from SQL injection attacks on authentication parameters, which could allow unverified attackers to bypass authenticatio...

Yinda Yunchuang Smart Integrated Management Platform System SQL Injection Vulnerability

Yinda Yunchuang Smart Integrated Management Platform System is a smart management system developed by Yinda Yunchuang. Versions of the Yinda Yunchuang Smart Integrated Management Platform System prior to 7.5 contained a SQL injection vulnerability. This vulnerability stemmed from incorrect...

WordPress plugin Electio has a SQL injection vulnerability.

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. WordPres...

WordPress plugin Allmart has a SQL injection vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. WordPres...

WordPress plugin Coven Core SQL injection vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application plugin. WordPress...

LangGraph.js injection vulnerability

LangGraph.js is an open-source large model orchestration framework developed by LangChain. Versions of LangGraph.js prior to 1.0.2 contained a injection vulnerability. This vulnerability stemmed from the lack of proper escaping of user input during filter processing, which could lead to query...

PT-2026-21147

Name of the Vulnerable Software and Affected Versions TeconceTheme Uroan Core versions through 1.4.4 Description A flaw exists in TeconceTheme Uroan Core that allows for Blind SQL Injection. This is due to improper neutralization of special elements used in an SQL command. Recommendations Update...

SvelteKit Access Control Vulnerability

SvelteKit is an open-source web development framework developed in Svelte. Versions of SvelteKit prior to 6.3.2 contained a access control vulnerability; this vulnerability stemmed from the ability for internal query parameters to be accessed, which could lead to cache poisoning...

CVE-2026-2435

Tanium addressed a SQL injection vulnerability in Asset...

amundsen-metadata (>=2.5.5, <=3.5.0), bspider (>=0.0.5a0, <=0.0.8) +13 more potentially affected by CVE-2026-27199 via werkzeug (0.15.5)

werkzeug PYPI version 0.15.5 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - amundsen-metadata =2.5.5, =0.0.5a0, =1.3.1, =1.2.3, =0.1.3, =0.0.1, =0.0.9, =0.50.0, =1.0.6, =0.1.0, =4.2.0, =0.10.21, =0.15.37 Source cves:...

Arbitrary Code Injection

Overview dtale is a Web Client for Visualizing Pandas Objects Affected versions of this package are vulnerable to Arbitrary Code Injection via the /save-column-filter endpoint due to the improper validation of input to pandas' DataFrame.query used to construct Column filters. An attacker can...

CVE-2025-59920

When hours are entered in time@work, version 7.0.5, it performs a query to display the projects assigned to the user. If the query URL is copied and opened in a new browser window, the ‘IDClient’ parameter is vulnerable to a blind authenticated SQL injection. If the request is made with the TWAdm...