CVE-2026-96429 Flowring Agentflow 4.0 - SQL Injection

SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2026-96429 Flowring Agentflow 4.0 - SQL Injection

SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2026-96428 Flowring Agentflow 4.0 - SQL Injection

SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the words parameter...

EUVD-2026-88655

SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the words parameter...

CVE-2026-96428 Flowring Agentflow 4.0 - SQL Injection

SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the words parameter...

CVE-2026-96428

A SQL Injection vulnerability exists in the Flowring Agentflow 4.0 software (versions before 2025/08/08 ). The flaw is located in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint, where remote attackers can execute arbitrary SQL commands by manipulating the words parameter. This vulnerability h...

WordPress Books Gallery plugin <= 4.8.3 - SQL Injection vulnerability

SQL Injection vulnerability discovered by sungbyeongchan in WordPress Plugin Books Gallery versions = 4.8.3...

sitesentinel

SiteSentinel A drop-in website security module that partici...

Exploit for CVE-2026-101110

CVE-2026-101110 — OrdaSoft Book Library Free unauthenticated...

EUVD-2026-88559

SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyuan.db. Attackers can craft malicious .sy documents with non-read-only SQL statements that execute automatically during background indexing, rendering, or export operations witho...

Exploit for CVE-2026-101108

CVE-2026-101108 — OrdaSoft Vehicle Manager Free unauthentica...

Exploit for CVE-2026-100752

CVE-2026-100752 — OrdaSoft Real Estate Manager Free unauthen...

PT-2026-102712

Name of the Vulnerable Software and Affected Versions Mediawiki - UserPageViewTracker Extension versions prior to 1.46.1 Mediawiki - UserPageViewTracker Extension version 1.45.5 Mediawiki - UserPageViewTracker Extension version 1.43.10 Description An unauthenticated SQL Injection occurs due to...

PT-2026-102813

A vulnerability was detected in risesoft-y9 WorkFlow-Engine up to 9.6.10. Impacted is the function getByIdAndYear of the file CustomHistoricProcessServiceImpl.java of the component OAuth2 Resource Filter. Performing a manipulation of the argument year/processInstanceId results in sql injection...

PT-2026-102901

The "screenID" parameter in the electronic transaction queue viewer feature within the manual transactions section is susceptible to a time-based blind SQL injection vulnerability...

PT-2026-102464

SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the id parameter...

PT-2026-102628

ClipBucket v5 through 5.5.3-197 contains a time-based blind SQL injection vulnerability in the language update function where the language id parameter is concatenated unescaped into the WHERE clause of an UPDATE statement. An authenticated administrator with basic settings permission can inject...

CVE-2026-68954: Improper Neutralization of Special Elements used in an SQL Command

The "pattern" parameter used in search function in the home page of the TMS application is vulnerable to time-based blind SQL injection vulnerability...

CVE-2026-96428: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the words parameter...

PT-2026-102500

The Apache Airflow Teradata provider's compute-cluster example Dag declared every one of its Dag Params as unconstrained free text and templated them straight into the compute-cluster operators, which interpolate those values into Teradata DDL. A user who is permitted to trigger that Dag - a...