PT-2026-102303

Name of the Vulnerable Software and Affected Versions Matrimonial System version 1.0 Description Remote SQL injection is possible via the Profile Creation Endpoint. The issue occurs in the processprofile form function within the /create profile file when handling the fname variable. SQL injection...

Harness Blind SQL Injection

Harness open source Gitness suffers from a registry related blind SQL injection vulnerability. https://packetstorm.news/download/233045...

CVE-2026-89303: Improper Neutralization of Special Elements used in an SQL Command

The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to perform SQL injection attacks...

PT-2026-99754

Name of the Vulnerable Software and Affected Versions DevaslanPHP project-management versions 1.2.1 through 1.2.4 DevaslanPHP project-management version 2.0.0-beta1 Description Remote SQL injection is possible within the Timesheet Dashboard component. The issue exists in the whereRaw function...

CVE-2026-100898: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/2.0.0-beta1. This affects the function whereRaw of the file app/Filament/Widgets/Timesheet/ActivitiesReport.php of the component Timesheet Dashboard. Performing a manipulation of the argument filter results in...

RHEL 8 : postgresql:12 (RHSA-2026:72363)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:72363 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Arbitrary code executi...

PT-2026-102301

Name of the Vulnerable Software and Affected Versions Real Estate Manager Free versions prior to 6.7.9 Description An unauthenticated SQL Injection exists in the site/realestatemanager.php endpoint. The issue occurs because the order field parameter is concatenated directly into an unquoted SQL...

PT-2026-99777

Name of the Vulnerable Software and Affected Versions Post Voting System WordPress plugin version 1.0 Description An issue exists where the software fails to properly sanitize and escape a parameter before incorporating it into a SQL query. This allows authenticated users to execute SQL injection...

PT-2026-99787

Name of the Vulnerable Software and Affected Versions CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be Description A remote SQL injection is possible due to improper handling of the makeid argument within an unknown function of the makeresult.php file. SQL...

CVE-2026-101011: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in aaPanel BaoTa up to 11.8.0. This affects the function getdomainstatus of the file /www/server/panel/mod/project/domain/domainMod.py of the component Domain Handler. The manipulation of the argument get results in sql injection. It is possible to launch the...

CVE-2026-101108: Improper Neutralization of Special Elements used in an SQL Command

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager Free 6.5.8 - site/vehiclemanager.php reads the orderfield and orderdirection sort parameters at three separate anonymous-reachable frontend entry points category listing, search, and the all-vehicles listing throug...

CVE-2026-100752: Improper Neutralization of Special Elements used in an SQL Command

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager Free 6.7.9 - site/realestatemanager.php builds the ORDER BY clause of three separate frontend property-listing queries category browsing, search results, and the full property listing from a request-controlled...

PT-2026-99780

Name of the Vulnerable Software and Affected Versions SPS-Suite WordPress plugin versions prior to 1.4.1 Description An issue exists when the static-page search feature is enabled, where the plugin fails to sanitize the search query before incorporating it into a SQL query. This allows...

PT-2026-102387

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.4 Description Insufficient validation of SQL statements in block query embed blocks executed against siyuan.db allows for the execution of non-read-only SQL statements. An attacker can create malicious .sy document...

CVE-2026-101105: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in code-projects Matrimonial System 1.0. The affected element is the function processprofileform of the file /createprofile of the component Profile Creation Endpoint. This manipulation of the argument fname causes sql injection. The attack is possible to be carried...

CVE-2026-73640: Improper Neutralization of Special Elements used in an SQL Command

Dayforce ESS Excelity is vulnerable to Time Based-Blind SQL Injection in password recovery functionality. The unauthenticated attacker can prepare GET request with one of the parameters filled in with an arbitrary SQL query. The parameter is interpreted as part of SQL predicate resulting in...

CVE-2026-93000: Improper Neutralization of Special Elements used in an SQL Command

The SPS-Suite WordPress plugin through 1.4.0 does not sanitise the search query before using it in a SQL query when its static-page search feature is enabled, allowing unauthenticated attackers to perform SQL injection attacks...

PT-2026-99886

Name of the Vulnerable Software and Affected Versions Dayforce Payroll version R2026.2.0 Description The password recovery functionality is susceptible to Time-Based Blind SQL Injection, a technique where an attacker determines information by observing the time the server takes to respond to...

CVE-2026-101010: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in aaPanel BaoTa up to 11.8.0. The impacted element is the function getData of the file /www/server/panel/class/data.py. The manipulation of the argument logtype leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly availabl...

PT-2026-99893

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Iron Mountain Archiving Services Inc. EnVision allows SQL Injection. This issue affects enVision: before 260655...