CVE-2026-19972

CVE-2026-19972 affects itsourcecode Hospital Management System 1.0, with SQL injection in an unknown function of /viewpatient.php via the delid parameter. Remote exploitation is possible, and public disclosure of the exploit is noted. Metrics indicate PoC exploit maturity (CVSS v4.0: 5.3 base, NE...

CVE-2026-19972

A vulnerability has been found in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /viewpatient.php. Such manipulation of the argument delid leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and ma...

CVE-2026-50769

The CRM+ application before and including version 2025.6 from Brainformatik is vulnerable to SQL Injection time-based vulnerability. The check conflict endpoint index.php?module=Appointments&action=CheckConflictOfDates&ajaxSkipHeader=true which is used to check any conflicts for user calendar is...

PT-2026-73420

Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9...

PT-2026-76741

The CRM+ application before and including version 2025.6 from Brainformatik is vulnerable to SQL Injection time-based vulnerability. The check conflict endpoint index.php?module=Appointments&action=CheckConflictOfDates&ajaxSkipHeader=true which is used to check any conflicts for user calendar is...

PT-2026-76727

Name of the Vulnerable Software and Affected Versions Page Builder CK versions prior to 3.6.5 Description The Page Builder CK extension for Joomla contains a SQL injection flaw within the styles model. This issue allows an attacker to interfere with the queries that an application makes to its...

PT-2026-76720

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format output format='python' and output format='php' and the corresponding sqlformat -l modes, allowing crafted SQL to terminate th...

CVE-2026-51346

StudIP (learning management system) has a SQL injection in its store() functions, affecting 6.0.x before 6.0.3 and 5.4.x before 5.4.12. CVSS 9.1 (network, no auth) allows unauthenticated remote attackers to execute arbitrary code and exfiltrate data. CISA SSVC flags it as PoC, automatable, total ...

CVE-2026-50769

The CRM+ application before and including version 2025.6 from Brainformatik is vulnerable to SQL Injection time-based vulnerability. The check conflict endpoint index.php?module=Appointments&action=CheckConflictOfDates&ajaxSkipHeader=true which is used to check any conflicts for user calendar is...

EUVD-2026-60312

SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive information via the store functions...

EUVD-2026-60357

The CRM+ application before and including version 2025.6 from Brainformatik is vulnerable to SQL Injection time-based vulnerability. The check conflict endpoint index.php?module=Appointments&action=CheckConflictOfDates&ajaxSkipHeader=true which is used to check any conflicts for user calendar is...

PT-2026-73366

Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9...

PT-2026-76883

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. This issue affects some unknown processing of the file /edit subject1.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit...

Progress MOVEit Transfer < 2025.0.7 / 2025.1.x < 2025.1.3 Multiple Vulnerabilities

The version of Progress MOVEit Transfer installed on the remote host is prior to 2025.0.7 or 2025.1.x prior to 2025.1.3. It is, therefore, affected by multiple vulnerabilities, including: - Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099512)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099512 advisory. Improper neutralization of newlines in pgdump in PostgreSQL allows a user of the origin server to inject arbitrary code for restore-time execution as the client...

CVE-2026-51346

SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive information via the store functions...

CVE-2026-50769

The CRM+ application before and including version 2025.6 from Brainformatik is vulnerable to SQL Injection time-based vulnerability. The check conflict endpoint index.php?module=Appointments&action=CheckConflictOfDates&ajaxSkipHeader=true which is used to check any conflicts for user calendar is...

PT-2026-76864

Name of the Vulnerable Software and Affected Versions Qcms version 6.0.6 Description An SQL Injection issue allows a remote attacker to execute arbitrary code. SQL Injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthoriz...

CVE-2026-51346

SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive information via the store functions...

EUVD-2026-60535

zuraCast versions up to and including 0.23.7 contain a SQL injection vulnerability in the backup restore functionality. The azuracast:restore command executes the db.sql file extracted from a backup archive without any content validation or sanitization. This allows a remote attacker to escalate...