Zoho ManageEngine OpManager - SQL Injection

Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL...

GLPI < 10.0.17 - Pre-Auth SQL Injection

A pre-authentication SQL injection vulnerability exists in the Inventory feature of GLPI. The vulnerability is caused by insufficient sanitization of user input in the handleAgent function when processing XML requests. The issue occurs because SimpleXMLElement objects can bypass the...

Web Directory Free < 1.7.0 - SQL Injection

The plugin does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection with different techniques like UNION, Time-Based and Error-Based. id: CVE-2024-3552 info: name: Web Directory Free 1.7.0 - SQL...

ApacheSkywalking

ApacheSkywalking ApacheSKywalking SQLi pour lire des fichiers sensibles...

CVE-2026-26980

CVE-2026-26980 ★ CVE-2026-26980 TryGhost Ghost CMS Content API Injection SQL PoC ★ https://github.com/user-attachments/assets/e7fab29e-8382-4ecc-986c-68852c28a32c Aperçu CVE-2026-26980 est une vulnérabilité d'injection SQL non authentifiée dans l'API Content de TryGhost Ghost CMS. Le chemin...

CVE-2026-32127_SqlInjectionVulnerabilityOpenEMR8.0.0

CVE-2026-32127 - Vulnérabilité d'injection SQL dans OpenEMR 8.0.0 Faiblesse CWE-89 Neutralisation incorrecte des éléments spéciaux utilisés dans une commande SQL « Injection SQL » Le produit construit tout ou partie d'une commande SQL à partir d'entrées influencées par l'extérieur provenant d'un...

CVE-2025-6783

احقن شرطًا صحيحًا دائمًا في جملة WHERE بحيث يتطابق كل صف: curl -i -X POST \ -H "Content-Type: application/json" \ -H "forms-id: poc-001' OR '1'='1' -- " \ -H "domain-id: example.com" \ -d ' "emabedtype":"iframe", "shortcodetitle":"INJECTED", "shortcodetag":"xss", "active":0 ' ...

CVE-2026-18782-TREX-MES-Uygulamalarinda-SQL-Zafiyeti

TREX-MES-Uygulamalarında-SQLi-Zafiyeti CVE-2026-18782 Vue d'ensemble TREX MES est une plateforme commerciale de Système d'Exécution de la Production MES / Industrie 4.0 utilisée pour collecter et gérer les données du terrain de production. L'API web de l'application exécute directement le paramèt...

EUVD-2026-95328

IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command...

EUVD-2026-95338

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute unauthorized SQL statements due to SQL injection...

EUVD-2026-95334

IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database...

EUVD-2025-211053

Jivejdon through 5.0 contains a sql injection vulnerability in AccountDaoSql.getAccountByNameLike that allows authenticated administrators to inject SQL via the username parameter. Attackers with the Admin role can submit crafted input to /admin/user/userListAction to read database contents,...

CVE-2025-46171

vBulletin 3.x.x - تعطيل الخدمة عبر إثقال قائمة الأصدقاء ملخص يقوم نقطة النهاية /misc.php?do=buddylist بتنفيذ استعلام JOIN واحد كبير يسترجع جميع الأصدقاء مع معلومات المستخدم والجلسة الخاصة بهم للتحقق من الحالة المتصلة. نظرًا لأن هذا الاستعلام يعالج قائمة الأصدقاء بأكملها دون ترقيم أو حدود للنتائج،...

PT-2026-108873

The Testimonials by BestWebSoft WordPress plugin through 1.0.8 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL to the query...

PT-2026-108852

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in wpdreams Ajax Search Pro ajax-search-pro allows Blind SQL Injection.This issue affects Ajax Search Pro: from n/a through 4.29.1...

PT-2026-108849

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in jegtheme JNews - Pay Writer jnews-pay-writer allows Blind SQL Injection.This issue affects JNews - Pay Writer: from n/a through 12.0.1...

PT-2026-108844

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in VibeThemes WPLMS wplms allows Blind SQL Injection.This issue affects WPLMS : from n/a through 4.973...

PT-2026-108847

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in UpSolution UpSolution Core us-core allows Blind SQL Injection.This issue affects UpSolution Core: from n/a through 9.3...

PT-2026-108832

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Blind SQL Injection.This issue affects ProfileGrid: from n/a through 6.0.0.2...

PT-2026-108843

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Taskbuilder Taskbuilder taskbuilder allows Blind SQL Injection.This issue affects Taskbuilder: from n/a through 6.0.5...