262485 matches found
EUVD-2026-84254
A security vulnerability has been detected in Yonyou U8cloud 5.x. This vulnerability affects unknown code of the file /u8cloud/openapi/so.saleorder.sendaudit of the component OpenAPI. The manipulation of the argument operator leads to sql injection. The attack can be initiated remotely. The explo...
CVE-2026-94492 Yonyou U8cloud OpenAPI so.saleorder.sendaudit sql injection
A security vulnerability has been detected in Yonyou U8cloud 5.x. This vulnerability affects unknown code of the file /u8cloud/openapi/so.saleorder.sendaudit of the component OpenAPI. The manipulation of the argument operator leads to sql injection. The attack can be initiated remotely. The explo...
CVE-2026-94492
A SQL injection vulnerability exists in Yonyou U8cloud 5.x , specifically in the OpenAPI component at the endpoint /u8cloud/openapi/so.saleorder.sendaudit. Manipulation of the operator argument allows a remote attacker with low privileges to inject SQL, leading to low impact on confidentiality, i...
CVE-2026-94491 Yonyou KSOA search_list.jsp sql injection
A weakness has been identified in Yonyou KSOA 9.0. This affects an unknown part of the file /cardcase/searchlist.jsp. Executing a manipulation of the argument address can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and cou...
CVE-2026-94491
Yonyou KSOA 9.0 contains a SQL injection vulnerability in the file /cardcase/search_list.jsp , triggered by manipulating the address argument. The attack can be launched remotely without authentication (CVSS 3.1 score: 7.3 , HIGH). The vendor was contacted but did not respond , and no official pa...
EUVD-2026-84252
A weakness has been identified in Yonyou KSOA 9.0. This affects an unknown part of the file /cardcase/searchlist.jsp. Executing a manipulation of the argument address can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and cou...
CVE-2026-94491 Yonyou KSOA search_list.jsp sql injection
A weakness has been identified in Yonyou KSOA 9.0. This affects an unknown part of the file /cardcase/searchlist.jsp. Executing a manipulation of the argument address can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and cou...
PT-2026-97117
Name of the Vulnerable Software and Affected Versions itsourcecode Leave Management System version 1.0 Description A remote SQL injection exists in the /module/leavetype/index.php endpoint. The issue occurs when the ID argument is manipulated, allowing an attacker to execute arbitrary SQL command...
PT-2026-97115
Name of the Vulnerable Software and Affected Versions TDuckCloud tduck-platform versions prior to 5.4 Description Remote SQL injection is possible through the manipulation of the orders0.column argument within the PaginationInnerInterceptor.concatOrderBy function, located in the...
PT-2026-96751
Name of the Vulnerable Software and Affected Versions NVIDIA Infrastructure Controller for Linux affected versions not specified Description An issue exists that allows an attacker to perform SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution. A...
PT-2026-96328
Name of the Vulnerable Software and Affected Versions Yonyou U8cloud versions 5.x Description A SQL injection issue exists within the OpenAPI component. A remote attacker can exploit this by manipulating the operator argument in the '/u8cloud/openapi/so.saleorder.sendaudit' endpoint. SQL injectio...
CVE-2026-94491: Improper Neutralization of Special Elements used in an SQL Command
A weakness has been identified in Yonyou KSOA 9.0. This affects an unknown part of the file /cardcase/searchlist.jsp. Executing a manipulation of the argument address can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and cou...
CVE-2026-95819: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in anirbandutta9 College-Notes-Gallery up to 8c1cf3d98f30982d069c88ca172612c001eb39f6. Affected by this vulnerability is an unknown functionality of the file login.php. Such manipulation of the argument user/pass leads to sql injection. The attack may be performed...
CVE-2026-88414: Improper Neutralization of Special Elements used in an SQL Command
MCMS 6.1.1 through 6.2.1 contains a SQL injection vulnerability in the PageAction.verify endpoint GET /ms/mdiy/page/verify.do...
CVE-2026-61685: Improper Neutralization of Special Elements used in an SQL Command
ReactPress is a publishing system for React developers. Prior to version 3.7.0, ReactPress API list endpoints build TypeORM QueryBuilder conditions using unsanitized HTTP query parameter names as SQL column identifiers e.g. article.$key . TypeORM parameterizes values but not column names, allowin...
CVE-2026-94117: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in DevItems HashBar – WordPress Notification Bar allows Blind SQL Injection. This issue affects HashBar – WordPress Notification Bar: from n/a through 2.0.3...
CVE-2026-88416
MCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/form import feature...
CVE-2026-88416
MCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/form import feature...
Traccar GPS Disclosure
The vulnerability of the Traccar GPS system’s application programming interface is related to the lack of measures taken to protect the SQL query structure when processing an HTTP DELETE /api/permissions request. Exploiting this vulnerability can allow a remote attacker to disclose sensitive...