285081 matches found
CVE-2026-79794: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to run arbitrary database...
PT-2026-106420
Name of the Vulnerable Software and Affected Versions Booknetic versions prior to 4.8.6 Description An unauthenticated SQL Injection exists in the software. SQL Injection is a type of vulnerability that allows an attacker to interfere with the queries that an application makes to its database,...
PT-2026-106407
Name of the Vulnerable Software and Affected Versions Mooberry Book Manager version 4.16.2 Description An SQL Injection issue exists in the subscriber component, allowing an attacker to interfere with the application's database queries. Recommendations At the moment, there is no information about...
PT-2026-106485
SQL injection SQLi vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/ajax/users.php?op=verify'. The parameter is vulnerable to boolean-based and time-based SQL injection. Successfully exploiting this vulnerability would allow an...
CVE-2026-105856: Improper Neutralization of Special Elements used in an SQL Command
Payload is a free and open source headless content management system. Prior to 3.90.0 and 4.0.0-canary.34, an attacker with read and create or update access to a collection containing a json field or a blocks field with blocksAsJSON enabled can inject SQL through a crafted field path and operator...
PT-2026-107144
Improper validation of selected CloudVision CUE application programming interface API request parameters may allow an authenticated network user to perform SQL injection against the backend impacting its availability...
CVE-2026-105471: Improper Neutralization of Special Elements used in an SQL Command
A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Impacted is an unknown function of the file signup.php of the component Registration Handler. The manipulation of the argument fname results in sql injection. The...
CVE-2026-102158: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Improper validation of selected CloudVision CUE application programming interface API request parameters may allow an authenticated network user to perform SQL injection against the backend impacting its availability...
PT-2026-106758
A vulnerability was identified in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This affects an unknown function of the file search class.php. Such manipulation of the argument school year leads to sql injection. The attack may be launched remotely. The...
PT-2026-106389
Subscriber SQL Injection in Paid Member Subscriptions = 3.1.1 versions...
AlmaLinux 9 : mariadb-connector-c (ALSA-2026:75673)
The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:75673 advisory. mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysqlrealescapestring CVE-2026-44172 Tenable has extracted t...
PT-2026-106461
Unauthenticated SQL Injection in SendPress Newsletters = 1.26.1.20 versions...
PT-2026-106728
Name of the Vulnerable Software and Affected Versions Kusalkasilva Learning-Management-System versions up to ffeb873f8803f1e9664384ff75000c7da45466d2 Description A remote SQL injection exists within the Student Registration Endpoint component, specifically affecting an unknown function in the...
PT-2026-106453
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Serhii Pasyuk Gmedia Photo Gallery grand-media allows Blind SQL Injection.This issue affects Gmedia Photo Gallery: from n/a through 1.25.1...
PT-2026-106421
Name of the Vulnerable Software and Affected Versions Woffice versions prior to 5.4.36 Description An SQL Injection issue exists in the subscriber component, allowing an attacker to interfere with the database queries. Recommendations Update to a version newer than 5.4.35...
CVE-2026-79798: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow a low-privileged authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to run arbitra...
CVE-2026-41555: Improper Neutralization of Special Elements used in an SQL Command
Unauthenticated SQL Injection in Newsletter Subscription Form – User Subscriptions Form, Capture Email = 1.5.9 versions...
AlmaLinux 8 : mariadb-connector-c (ALSA-2026:75674)
The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:75674 advisory. mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysqlrealescapestring CVE-2026-44172 Tenable has extracted t...
CVE-2026-103059: Authentication Bypass by Primary Weakness
When Gitea's built-in SSH server is enabled STARTSSHSERVER = true, the presented public key was looked up with an SQL LIKE comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can construct a case variant of another user's...