PT-2026-102306

Name of the Vulnerable Software and Affected Versions Book Library Free versions prior to 6.4.6 Description An unauthenticated SQL Injection exists in the books function within the site/booklibrary.php file. The issue occurs when the function processes the field and direction request parameters...

PT-2026-99836

A vulnerability was determined in dayrui XunruiCMS up to 4.7.2. This issue affects the function group all edit of the file dayrui/App/Member/Controllers/Admin/Home.php of the component Group Editing. This manipulation of the argument groupid causes sql injection. The attack is possible to be...

PT-2026-99780

Name of the Vulnerable Software and Affected Versions SPS-Suite WordPress plugin versions prior to 1.4.1 Description An issue exists when the static-page search feature is enabled, where the plugin fails to sanitize the search query before incorporating it into a SQL query. This allows...

CVE-2026-100752: Improper Neutralization of Special Elements used in an SQL Command

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager Free 6.7.9 - site/realestatemanager.php builds the ORDER BY clause of three separate frontend property-listing queries category browsing, search results, and the full property listing from a request-controlled...

RHEL 8 : postgresql:12 (RHSA-2026:72363)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:72363 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Arbitrary code executi...

PT-2026-99754

Name of the Vulnerable Software and Affected Versions DevaslanPHP project-management versions 1.2.1 through 1.2.4 DevaslanPHP project-management version 2.0.0-beta1 Description Remote SQL injection is possible within the Timesheet Dashboard component. The issue exists in the whereRaw function...

PT-2026-102387

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.4 Description Insufficient validation of SQL statements in block query embed blocks executed against siyuan.db allows for the execution of non-read-only SQL statements. An attacker can create malicious .sy document...

CVE-2026-101091: Improper Neutralization of Special Elements used in an SQL Command

SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyuan.db. Attackers can craft malicious .sy documents with non-read-only SQL statements that execute automatically during background indexing, rendering, or export operations witho...

CVE-2026-101011: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in aaPanel BaoTa up to 11.8.0. This affects the function getdomainstatus of the file /www/server/panel/mod/project/domain/domainMod.py of the component Domain Handler. The manipulation of the argument get results in sql injection. It is possible to launch the...

Harness Blind SQL Injection

Harness open source Gitness suffers from a registry related blind SQL injection vulnerability. https://packetstorm.news/download/233045...

Update Rollup 4 for System Center 2022 Data Protection Manager

Update Rollup 4 for System Center 2022 Data Protection Manager Applies to: System Center 2022 Data Protection Manager Introduction This article describes the issues that are fixed in Update Rollup 4 for Microsoft System Center Data Protection Manager 2022. It also contains the installation...

CVE-2026-73640: Improper Neutralization of Special Elements used in an SQL Command

Dayforce ESS Excelity is vulnerable to Time Based-Blind SQL Injection in password recovery functionality. The unauthenticated attacker can prepare GET request with one of the parameters filled in with an arbitrary SQL query. The parameter is interpreted as part of SQL predicate resulting in...

CVE-2026-101105: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in code-projects Matrimonial System 1.0. The affected element is the function processprofileform of the file /createprofile of the component Profile Creation Endpoint. This manipulation of the argument fname causes sql injection. The attack is possible to be carried...

PT-2026-99777

Name of the Vulnerable Software and Affected Versions Post Voting System WordPress plugin version 1.0 Description An issue exists where the software fails to properly sanitize and escape a parameter before incorporating it into a SQL query. This allows authenticated users to execute SQL injection...

CVE-2026-101110: Improper Neutralization of Special Elements used in an SQL Command

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library Free quote instead of rejecting it. The value is then concatenated directly into an unquoted ORDER BY clause, a position where quoting provides no protection at all. Reaching the vulnerable code path requires two...

PT-2026-99893

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Iron Mountain Archiving Services Inc. EnVision allows SQL Injection. This issue affects enVision: before 260655...

CVE-2026-101108: Improper Neutralization of Special Elements used in an SQL Command

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager Free 6.5.8 - site/vehiclemanager.php reads the orderfield and orderdirection sort parameters at three separate anonymous-reachable frontend entry points category listing, search, and the all-vehicles listing throug...

CVE-2026-86595: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Iron Mountain Archiving Services Inc. EnVision allows SQL Injection. This issue affects enVision: before 260655...

CVE-2026-101013: Improper Neutralization of Special Elements used in an SQL Command

A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file updateresultdetails.php. Such manipulation of the argument editid leads to sql injection. The attack can be launched...

MiracleLinux 9 : postgresql:18 (AXSA:2026-1927:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1927:01 advisory. postgresql: PostgreSQL: SQL injection in pgcreatesubscriber allows arbitrary SQL execution as superuser CVE-2026-6476 postgresql: PostgreSQL:...