EUVD-2026-107699

Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.getevents method, which fails to properly neutralize user-supplied input before including it in SQL queries. Authenticated attackers can send crafted input to getevents and infer...

CVE-2026-114664

The Frappe Framework before version 16.33.0 is vulnerable to a blind SQL injection in the frappe.desk.doctype.event.event.get_events method. The root cause is the failure to properly neutralize user-supplied input before it is included in SQL queries. Authenticated attackers can provide crafted i...

CVE-2026-87936

The Drupal amazee.ai Private AI Provider module (versions 0.0.0 to 1.3.7 and 1.4.0 to 1.4.3 ) is vulnerable to SQL Injection due to improper sanitization of filter values used to build queries in its Postgres/pgvector vector database backend. This occurs when a site uses this backend for a Search...

CVE-2026-87936 amazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-134

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3.7, from 1.4.0 to 1.4.3...

CVE-2026-87936 amazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-134

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3.7, from 1.4.0 to 1.4.3...

EUVD-2026-107865

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3.7, from 1.4.0 to 1.4.3...

CVE-2026-87936

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3.7, from 1.4.0 to 1.4.3...

EUVD-2026-107863

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Drupal CSP log allows SQL Injection. This issue affects CSP log versions: from 0.0.0 to 1.0.2...

CVE-2026-87938 CSP log - Critical - SQL Injection - SA-CONTRIB-2026-136

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Drupal CSP log allows SQL Injection. This issue affects CSP log versions: from 0.0.0 to 1.0.2...

CVE-2026-87938

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Drupal CSP log allows SQL Injection. This issue affects CSP log versions: from 0.0.0 to 1.0.2...

CVE-2026-87938

The CSP Log module for Drupal (versions 0.0.0 to 1.0.2 ) is vulnerable to SQL Injection due to insufficient sanitization of user-supplied values used in database queries. An attacker must possess an account with the Access CSP reports permission to exploit this vulnerability. Exploitation details...

EUVD-2026-107665

A weakness has been identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/update.php. This manipulation of the argument action/fullname/visano/hiden/title/description/pageid/user causes sql injection. The attack may be initiated remotely. T...

EUVD-2026-107574

A vulnerability was determined in itsourcecode Online Cake Ordering System 1.0. The affected element is an unknown function of the file /orderdetail.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly...

EUVD-2026-107584

A security vulnerability has been detected in itsourcecode Online Cake Ordering System 1.0. Affected is an unknown function of the file /transactionsave.php. Such manipulation of the argument del leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly...

EUVD-2026-107667

A vulnerability was identified in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/delete.php. The manipulation of the argument costomerid/ticketid/paymentid/id/documentid/salaryid/empid/userid leads to sql injection. The attack can be initiated remotely. The...

Security Advisory 0199

Security Advisory 0199 . CSAF PDF Date: October 22, 2026 Revision | Date | Changes ---|---|--- 1.0 | October 22, 2026 | Initial release The CVE-ID tracking this issue: CVE-2026-114625 CVSSv3.1 Base Score: 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSSv4.0 Base Score: 9.4...

PT-2026-121353

Name of the Vulnerable Software and Affected Versions i-Netsolution Readymade Unilevel Ecommerce MLM version 2024-03-15 build Description An SQL injection flaw allows unauthenticated attackers to manipulate database queries. Attackers can extract database information by sending GET requests to th...

PT-2026-121506

Name of the Vulnerable Software and Affected Versions Arista VeloCloud Orchestrator versions prior to 5.2.3.18 Arista VeloCloud Orchestrator versions prior to 6.1.3.10 Arista VeloCloud Orchestrator versions prior to 6.4.2.12 Description A critical SQL injection flaw exists in on-premises...

VulnCheck KEV: CVE-2019-25778

SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist array parameter. Attackers can send GET requests to /comment/api/index.php with crafted rlist values using backtick-quoted...

VulnCheck KEV: CVE-2022-51021

NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by supplying an array-form 'id' parameter to /wp-json/notificationx/v1/notification/id. Attackers can pass id1 with crafted SQ...