288224 matches found
CVE-2026-95927: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was identified in SourceCodester Online Reviewer Management System 1.0. This affects an unknown function of the file /reviewer0/admins/assessments/pretest/exam-delete.php. Such manipulation of the argument testid leads to sql injection. The attack may be performed from remote. The...
CVE-2025-63564: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP requests...
CVE-2026-95929: Improper Neutralization of Special Elements used in an SQL Command
A weakness has been identified in iFlytek astron-agent up to 1.0.7. Affected is an unknown function of the file console/backend/commons/src/main/resources/mapper/ChatBotMarketMapper.xml of the component getBotList API endpoint. Executing a manipulation of the argument sortDirection can lead to sq...
CVE-2026-90901: Improper Neutralization of Special Elements used in an SQL Command
Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0 - The media deletion endpoint administrator/index.php?option=comeasystore&task=media.deleteImage parsed the ids parameter as a comma-separated string and implode...
CVE-2026-93368: Improper Neutralization of Special Elements used in an SQL Command
The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' Username Parameter in all versions up to, and including, 2.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
CVE-2026-95593: Improper Neutralization of Special Elements used in an SQL Command
Editor SQL Injection in Ultimeter = 3.0.8 versions...
PT-2026-97489
Unauthenticated SQL Injection in Product Filter by WBW = 3.1.7 versions...
PT-2026-97316
Name of the Vulnerable Software and Affected Versions ManageEngine Applications Manager versions 182000 and earlier Description A low-privileged user can execute unauthorized SQL commands, which may lead to the attainment of administrator privileges and remote code execution RCE, a process where ...
EUVD-2025-210998
SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP requests...
CVE-2026-94174: Improper Neutralization of Special Elements used in an SQL Command
Administrator SQL Injection in Email Log = 2.63 versions...
PT-2026-97125
Name of the Vulnerable Software and Affected Versions SourceCodester Online Reviewer Management System version 1.0 Description A remote SQL injection is possible due to improper handling of the test id argument within an unknown function in the '/reviewer 0/admins/assessments/pretest/btn...
PT-2026-97349
Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description A SQL injection flaw exists that could allow a remote authenticated attacker to obtain sensitive information. SQL injection is a technique...
PT-2026-97514
Name of the Vulnerable Software and Affected Versions Easy Store versions 1.0.0 through 3.0.0 Description An authenticated administrator can perform a SQL Injection through the coupon bulk update task. The issue occurs because the application takes input IDs and directly concatenates them into ra...
CVE-2025-63564
The Moodle Socialwall plugin versions v.3.0 through v.3.3 are affected by a SQL injection vulnerability. An attacker can exploit this flaw by sending crafted HTTP requests , which may lead to the execution of arbitrary code . The vulnerability is classified with a CRITICAL base severity score of ...
Cisco Identity Services Engine SQL Injection
The vulnerability of the Cisco Identity Services Engine ISE platform relates to the lack of security measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
Cisco Identity Services Engine SQL Injection
The vulnerability of the Cisco Identity Services Engine ISE platform relates to the lack of security measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
CVE-2026-96604: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was identified in SoftNews Media Group DataLife Engine 18.0. This affects the function stripdata of the file engine/modules/search.php of the component Search Module. The manipulation of the argument story leads to sql injection. The attack can be initiated remotely. The exploit i...
PT-2026-97513
Name of the Vulnerable Software and Affected Versions Easy Store versions 1.0.0 through 3.0.0 Description Two distinct issues exist in the extension. First, the endpoint 'administrator/index.php?option=com easystore&task=media.deleteImage' fails to properly sanitize the ids parameter, which is...