EUVD-2026-107667

A vulnerability was identified in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/delete.php. The manipulation of the argument costomerid/ticketid/paymentid/id/documentid/salaryid/empid/userid leads to sql injection. The attack can be initiated remotely. The...

Security Advisory 0199

Security Advisory 0199 . CSAF PDF Date: October 22, 2026 Revision | Date | Changes ---|---|--- 1.0 | October 22, 2026 | Initial release The CVE-ID tracking this issue: CVE-2026-114625 CVSSv3.1 Base Score: 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSSv4.0 Base Score: 9.4...

VulnCheck KEV: CVE-2019-25778

SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist array parameter. Attackers can send GET requests to /comment/api/index.php with crafted rlist values using backtick-quoted...

VulnCheck KEV: CVE-2022-51021

NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by supplying an array-form 'id' parameter to /wp-json/notificationx/v1/notification/id. Attackers can pass id1 with crafted SQ...

VulnCheck KEV: CVE-2024-58393

i-Netsolution Readymade Unilevel Ecommerce MLM 2024-03-15 build contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries through the 'id' parameter. Attackers can send GET requests to /product-details.php with boolean-based, stacked, or time-bas...

PT-2026-121506

Name of the Vulnerable Software and Affected Versions Arista VeloCloud Orchestrator versions prior to 5.2.3.18 Arista VeloCloud Orchestrator versions prior to 6.1.3.10 Arista VeloCloud Orchestrator versions prior to 6.4.2.12 Description A critical SQL injection flaw exists in on-premises...

VulnCheck KEV: CVE-2022-51023

PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameter. Attackers can send GET requests to /api.php?c=project&f=index with extractvalue payloads in sort to extract database information throug...

PT-2026-121380

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in AmentoTech Workreap Core workreap core allows Blind SQL Injection.This issue affects Workreap Core: from n/a before 3.4.4...

PT-2026-121353

Name of the Vulnerable Software and Affected Versions i-Netsolution Readymade Unilevel Ecommerce MLM version 2024-03-15 build Description An SQL injection flaw allows unauthenticated attackers to manipulate database queries. Attackers can extract database information by sending GET requests to th...

PT-2026-121362

mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector stores/databricks.py that allows attackers to inject SQL by influencing stored memory content. Attackers can supply crafted memory text, metadata, or message names that reach unescaped insert and update string...

AlmaLinux 9.2 [TuxCare] Security Update: mariadb / mariadb-backup / mariadb-common / mariadb-devel / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792636681)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792636681 advisory. - MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and...

Linux Distros Unpatched Vulnerability : CVE-2026-79752

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract,...

Oracle Linux 8 : php:7.4 (ELSA-2026-87080)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-87080 advisory. - Avoid state corruption via bailout CVE-2026-109618, CVE-2026-109619 - Fix IPv6 ACL bypass in FastCGI listen.allowedclients due to partial address...

CVE-2026-114441

A weakness has been identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/update.php. This manipulation of the argument action/fullname/visano/hiden/title/description/pageid/user causes sql injection. The attack may be initiated remotely. T...

CVE-2026-114440

A vulnerability was identified in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/delete.php. The manipulation of the argument costomerid/ticketid/paymentid/id/documentid/salaryid/empid/userid leads to sql injection. The attack can be initiated remotely. The...

CVE-2026-114441 oretnom23 php-travel-agency-system update.php sql injection

A weakness has been identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/update.php. This manipulation of the argument action/fullname/visano/hiden/title/description/pageid/user causes sql injection. The attack may be initiated remotely. T...

CVE-2026-114441

The oretnom23 php-travel-agency-system software contains a SQL injection vulnerability affecting the processing of the admin/update.php file. Attackers can initiate this attack remotely by manipulating specific arguments, including action , full_name , visa_no , hiden , title , description , page...

CVE-2026-114441 oretnom23 php-travel-agency-system update.php sql injection

A weakness has been identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/update.php. This manipulation of the argument action/fullname/visano/hiden/title/description/pageid/user causes sql injection. The attack may be initiated remotely. T...

CVE-2026-114440

A SQL injection vulnerability exists in the oretnom23 php-travel-agency-system within the admin/delete.php file. Attackers can initiate a remote attack by manipulating the costomer_id , ticket_id , payment_id , id , document_id , salary_id , emp_id , or user_id arguments. While the exploit is pub...

CVE-2026-114440 oretnom23 php-travel-agency-system delete.php sql injection

A vulnerability was identified in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/delete.php. The manipulation of the argument costomerid/ticketid/paymentid/id/documentid/salaryid/empid/userid leads to sql injection. The attack can be initiated remotely. The...