CVE-2026-94110 QCMS Content Detail Controllers.php self_Tmp sql injection

A security vulnerability has been detected in QCMS up to 6.0.6. This issue affects the function selfTmp in the library Lib/Config/Controllers.php of the component Content Detail Page. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit...

EUVD-2026-83822

A security vulnerability has been detected in QCMS up to 6.0.6. This issue affects the function selfTmp in the library Lib/Config/Controllers.php of the component Content Detail Page. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit...

CVE-2026-94110

QCMS up to 6.0.6 is vulnerable to a remote SQL injection in the self_Tmp function of Lib/Config/Controllers.php (Content Detail Page component). The root cause is unsanitized use of the ID argument. A publicly disclosed proof-of-concept exploit is available. Notably, the router parses raw REQUEST...

Linux Distros Unpatched Vulnerability : CVE-2026-54354

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MapServer is a system for developing web-based GIS applications. Prior to 8.6.4, MapServer's PostGIS runtime filter translation in src/mappostgis.cpp and...

MariaDB SQL Injection

The vulnerability of the mysqlrealescapestring function in the MariaDB database management system is related to the lack of protective measures for SQL query structures. Exploiting this vulnerability allows an attacker to execute SQL injections remotely...

CVE-2026-88756

Pagekit CMS = 1.0.18 allows an unauthenticated attacker to perform SQL injection through the credentials array submitted to the public login endpoint POST /user/authenticate...

CVE-2026-88756

Pagekit CMS = 1.0.18 allows an unauthenticated attacker to perform SQL injection through the credentials array submitted to the public login endpoint POST /user/authenticate...

CVE-2026-88756: Improper Neutralization of Special Elements used in an SQL Command

Pagekit CMS = 1.0.18 allows an unauthenticated attacker to perform SQL injection through the credentials array submitted to the public login endpoint POST /user/authenticate...

CVE-2026-88402: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allows attackers to access sesntive database information via injecting crafted SQL statements...

CVE-2026-88402

A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allows attackers to access sesntive database information via injecting crafted SQL statements...

CVE-2026-65980: Improper Neutralization of Special Elements used in an SQL Command

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, Chartbrew's ClickHouse protocol in server/sources/plugins/clickhouse/clickhouse.protocol.js calls applySqlVariables from...

CVE-2026-61852: Improper Neutralization of Special Elements used in an SQL Command

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery implementation in server/modules/ai/orchestrator/tools/runQuery.js interpolates the AI tool's rowlimit parameter into a SQL LIMIT...

CVE-2026-94144: Improper Neutralization of Special Elements used in an SQL Command

A flaw has been found in drogonframework drogon up to 1.9.13. This affects the function makeCriteria in the library ormlib/src/Criteria.cc of the component ORM. Executing a manipulation of the argument filter can lead to sql injection. The attack may be performed from remote. The exploit has been...

CVE-2026-94110: Improper Neutralization of Special Elements used in an SQL Command

A security vulnerability has been detected in QCMS up to 6.0.6. This issue affects the function selfTmp in the library Lib/Config/Controllers.php of the component Content Detail Page. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit...

PT-2026-96302

Name of the Vulnerable Software and Affected Versions Chartbrew versions prior to 5.2.3 Description Chartbrew's ClickHouse protocol in server/sources/plugins/clickhouse/clickhouse.protocol.js calls the applySqlVariables function from server/sources/shared/sql/sql.variables.js without enabling the...

PT-2026-96030

Name of the Vulnerable Software and Affected Versions QCMS versions prior to 6.0.7 Description A remote SQL injection exists in the Content Detail Page component within the self Tmp function located in the Lib/Config/Controllers.php library. The issue occurs when the ID argument is manipulated...

PT-2026-96288

Name of the Vulnerable Software and Affected Versions nocobase version 2.1.21 Description A SQL injection issue exists in the checkSQL function, which allows attackers to access sensitive database information by injecting crafted SQL statements. SQL injection is a technique where malicious SQL co...

PT-2026-96305

Name of the Vulnerable Software and Affected Versions Pagekit CMS versions prior to 1.0.19 Description An unauthenticated attacker can perform SQL injection, a technique used to manipulate database queries, by submitting a malicious credentials array to the public login endpoint 'POST...

PT-2026-96045

Name of the Vulnerable Software and Affected Versions drogonframework drogon versions prior to 1.9.14 Description A flaw in the ORM component affects the makeCriteria function within the orm lib/src/Criteria.cc library. A remote attacker can perform a SQL injection by manipulating the filter...

VulnCheck KEV: CVE-2026-48842

Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuserquery plugin via a pregreplace backslash escape bypass...