261984 matches found
PT-2026-103078
Name of the Vulnerable Software and Affected Versions EasyFlow .NET affected versions not specified Description An SQL Injection flaw allows authenticated remote attackers to inject arbitrary SQL commands, enabling them to read sensitive database contents. Recommendations At the moment, there is ...
PT-2026-103599
Name of the Vulnerable Software and Affected Versions Kiteworks Secure Data Forms affected versions not specified Description An authenticated user can perform a SQL injection by influencing a value derived from their stored account data, which is incorporated into a database query without proper...
PT-2026-103260
Name of the Vulnerable Software and Affected Versions Event Tickets versions prior to 5.29.6 Description An improper neutralization of special elements used in an SQL command allows for Blind SQL Injection. This occurs when the application fails to properly sanitize input, enabling an attacker to...
PT-2026-103536
Name of the Vulnerable Software and Affected Versions Kiteworks Core versions prior to 9.5.0 Description A stored SQL injection exists within an administrative reporting feature. This issue allows an authenticated administrator to read sensitive data from the underlying database and potentially...
PT-2026-103293
Name of the Vulnerable Software and Affected Versions Trex MES versions prior to 2026-09-29 Description Improper neutralization of special elements used in an SQL command allows for SQL injection, which can lead to Command Line Execution. Recommendations Update Trex MES to a version released afte...
CVE-2026-62085: Improper Neutralization of Special Elements used in an SQL Command
Administrator SQL Injection in WP Activity Log = 5.6.6 versions...
CVE-2026-102098: Improper Neutralization of Special Elements used in an SQL Command
Kiteworks Core before version 9.5.0 is vulnerable to SQL Injection. A stored SQL injection vulnerability in a Kiteworks administrative reporting feature could allow an authenticated administrator to read sensitive data from the underlying database and to affect the availability of the service...
PT-2026-102968
Zetetic SQLCipher before 4.15.0 allows SQL injection. The sqlcipher export convenience function can be used to copy the contents of one attached database into another. It is most often used to convert between plaintext and encrypted databases. It needs to do dynamic schema manipulation, and thus...
CVE-2026-103117: Improper Neutralization of Special Elements used in an SQL Command
A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function dbproperties of the file functions/DatabaseInc.php of the component Save Data Handler. Such manipulation of the argument values leads to sql injection. The attack can be launched remotely. The...
VulnCheck KEV: CVE-2020-22209
SQL Injection in 74cms 3.2.0 via the query parameter to plus/ajaxcommon.php...
CVE-2026-103231: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. The affected element is the function mysqliquery of the file User/cancel.php of the component Order Cancellation. The manipulation of the argument ID leads to sql injectio...
CVE-2026-18782: Improper Neutralization of Special Elements used in an SQL Command
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Command Line Execution through SQL Injection. This issue affects Trex MES: through 2026-09-29...
PT-2026-103331
A vulnerability was determined in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Impacted is the function mysqli query of the file User/ord.php of the component Order Placement. Executing a manipulation of the argument id/name can lead to sql injection...
PT-2026-103019
A security flaw has been discovered in SourceCodester Car Driving School Management System 1.0. Impacted is an unknown function of the file /classes/Master.php?f=save enrollment. The manipulation results in sql injection. The attack can be executed remotely. The exploit has been released to the...
PT-2026-103154
Administrator SQL Injection in WP Activity Log = 5.6.6 versions...
WordPress WPML Multilingual & Multicurrency for WooCommerce plugin <= 5.5.7 - Authenticated (Shop Manager+) SQL Injection vulnerability
Authenticated Shop Manager+ SQL Injection vulnerability discovered by Muni Nitish Kumar Yaddala Stranger825 in WordPress Plugin WooCommerce Multilingual & Multicurrency versions = 5.5.7...
PT-2026-103174
Name of the Vulnerable Software and Affected Versions GamiPress versions prior to 8.0.3 Description An improper neutralization of special elements used in an SQL command allows for unauthenticated Blind SQL Injection. Blind SQL Injection is a technique where an attacker asks the database true or...
PT-2026-103018
A vulnerability was identified in SourceCodester Online Leave Management System 1.0. This issue affects some unknown processing of the file /admin/?page=reports. The manipulation of the argument date start/date end leads to sql injection. Remote exploitation of the attack is possible. The exploit...
PT-2026-103014
A security flaw has been discovered in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /reviewer 0/admins/assessments/examproper/exam-delete.php. The manipulation of the argument test id results in sql injection. The attack can be...