CVE-2026-15918 VikAppointments – Services Booking Calendar <= 1.2.19 - Unauthenticated SQL Injection

VikAppointments Service Booking Calendar wordpress plugin is vulnerable to unauthenticated SQL injection due to one of the parameters that controls how the public reviews list is sorted is taken from the incoming request and used to build a database query without proper validation or sanitization...

EUVD-2026-53038

VikAppointments Service Booking Calendar wordpress plugin is vulnerable to unauthenticated SQL injection due to one of the parameters that controls how the public reviews list is sorted is taken from the incoming request and used to build a database query without proper validation or sanitization...

CVE-2026-18896 lavkush-maurya Student-Registration-System changepass.php sql injection

A vulnerability was determined in lavkush-maurya Student-Registration-System 1.0. The affected element is an unknown function of the file /student/changepass.php. Executing a manipulation of the argument oldpass can lead to sql injection. It is possible to launch the attack remotely. The exploit...

CVE-2026-18859

A vulnerability was identified in ESAFENET CDG up to 20260615. Affected is an unknown function of the file /CDGServer3/ukey/usbkey;logindojojs. Such manipulation of the argument keyid leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be...

CVE-2026-18859 ESAFENET CDG usbkey;logindojojs sql injection

A vulnerability was identified in ESAFENET CDG up to 20260615. Affected is an unknown function of the file /CDGServer3/ukey/usbkey;logindojojs. Such manipulation of the argument keyid leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be...

CVE-2026-18859

CVE-2026-18859 affects ESAFENET CDG (up to 20260615). The vulnerability is tied to an unknown function in the file /CDGServer3/ukey/usbkey;logindojojs, where manipulation of the argument keyid leads to SQL injection. Attacks may be performed remotely, and a public exploit is reported as available...

CVE-2026-18854

A vulnerability has been found in Shandong Hoteam PDM Product Data Management System up to 8.3.10. The impacted element is the function GetStoredClassByFilter of the file /Base/BaseService.asmx/DataService. The manipulation of the argument FilterString leads to sql injection. Remote exploitation ...

CVE-2026-18854 Shandong Hoteam PDM Product Data Management System DataService GetStoredClassByFilter sql injection

A vulnerability has been found in Shandong Hoteam PDM Product Data Management System up to 8.3.10. The impacted element is the function GetStoredClassByFilter of the file /Base/BaseService.asmx/DataService. The manipulation of the argument FilterString leads to sql injection. Remote exploitation ...

EUVD-2026-53011

A vulnerability has been found in Shandong Hoteam PDM Product Data Management System up to 8.3.10. The impacted element is the function GetStoredClassByFilter of the file /Base/BaseService.asmx/DataService. The manipulation of the argument FilterString leads to sql injection. Remote exploitation ...

📄 FineAdmin.Mvc SQL Injection

A proof of concept exploit for a SQL injection vulnerability in FineAdmin.Mvc. Insufficient validation of the field and order parameters allows arbitrary SQL expressions to be injected into the ORDER BY clause, enabling error-based and time-based SQL injection against affected endpoints...

CVE-2026-69704

CVE-2026-69704 affects Atals-Livre and describes a SQL injection vulnerability in the supp() deletion helper function where unsanitized input passed via a GET parameter is used to manipulate database queries. The vulnerability enables attackers to craft input to perform unauthorized database oper...

EUVD-2026-52868

Atals-Livre contains a SQL injection vulnerability that allows attackers to manipulate database queries by passing unsanitized input through a GET parameter to the supp deletion helper function. Attackers can inject malicious SQL syntax via the vulnerable GET parameter to perform unauthorized...

postgresql: PostgreSQL: Arbitrary code execution vulnerability in 'refint' module

A flaw was found in PostgreSQL. A stack buffer overflow in the 'refint' module allows an unprivileged database user to execute arbitrary code as the operating system user running the database. Additionally, a separate vulnerability exists where, if an application uses a user-controlled column as ...

WordPress Relevanssi Premium – A Better Search plugin <= 2.30.2 - Authenticated (Contributor+) SQL Injection vulnerability

Authenticated Contributor+ SQL Injection vulnerability discovered by daroo in WordPress Plugin Relevanssi Premium versions = 2.30.2...

CVE-2026-18801

OpenMeter contains a stored, or second-order, SQL injection vulnerability in the handling of customer usage-attribution values. An attacker who can create or update a customer can store a malicious value in the usageAttribution.key or usageAttribution.subjectKeys fields. When that customer is...

Flowise RCE via SQLite Record Manager Node

============================================================================= Security Advisory elttam Topic: Flowise RCE via SQLite Record Manager Node Module: FlowiseAI/Flowise Disclosed: 24-Apr-2026 Credits: Alex Brown Affects: FlowiseAI/Flowise 3.1.2 I. Background Flowise AI is an open-source...

CVE-2026-64631

A vulnerability allowing a low-privileged user to inject SQL and extract database contents...

CVE-2026-64631

CVE-2026-64631 describes an SQL injection vulnerability exploitable by a low-privilege user that can extract database contents. According to the provided metrics, the vulnerability has HIGH base severity (CVSS 4.0, score 8.5) with network attack vector, low attack complexity, and no user interact...

Malicious code in @servicetitan/admin-sql-table (npm)

npm/@servicetitan/admin-sql-table is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

CVE-2026-18766

A flaw has been found in chetans9 core-php-admin-panel up to 90d07ed5aac5e0f09b6a5828d7bb2eb83010763f. This issue affects some unknown processing of the file /Applications/MAMP/htdocs/core-php-admin-panel-master/customers.php. Executing a manipulation of the argument filtercol can lead to sql...