CVE-2026-102499

The Modern Events Calendar Lite and Modern Event Calendar Pro WordPress plugins, in versions before 7.37.0 , are vulnerable to SQL Injection via the mec_attendees AJAX Action . The root cause is the failure to properly sanitise and escape a parameter used within a SQL statement. This allows authe...

CVE-2026-102499 Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_attendees AJAX Action

The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL...

EUVD-2026-107049

The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL...

CVE-2026-114039

A weakness has been identified in projectworlds Advanced Library Management System 1.0. Impacted is the function mysqliquery of the file reportsearch.php. Executing a manipulation of the argument dateto/datefrom can lead to sql injection. The attack can be executed remotely. The exploit has been...

CVE-2026-114039 projectworlds Advanced Library Management System report_search.php mysqli_query sql injection

A weakness has been identified in projectworlds Advanced Library Management System 1.0. Impacted is the function mysqliquery of the file reportsearch.php. Executing a manipulation of the argument dateto/datefrom can lead to sql injection. The attack can be executed remotely. The exploit has been...

CVE-2026-114039 projectworlds Advanced Library Management System report_search.php mysqli_query sql injection

A weakness has been identified in projectworlds Advanced Library Management System 1.0. Impacted is the function mysqliquery of the file reportsearch.php. Executing a manipulation of the argument dateto/datefrom can lead to sql injection. The attack can be executed remotely. The exploit has been...

EUVD-2026-107039

A weakness has been identified in projectworlds Advanced Library Management System 1.0. Impacted is the function mysqliquery of the file reportsearch.php. Executing a manipulation of the argument dateto/datefrom can lead to sql injection. The attack can be executed remotely. The exploit has been...

CVE-2026-114039

A SQL injection vulnerability exists in the projectworlds Advanced Library Management System 1.0 . The flaw is located in the mysqli_query function within the report_search.php file, where insufficient sanitization of the dateto and datefrom arguments allows for remote exploitation. Publicly avai...

CVE-2026-114099

Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGSPOST names without escaping literal dots, so distinct properties collide. Unauthenticated attackers can add a later dotted property such as account.role that overwrites a malicious nest...

CVE-2026-114081

Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without allowlisting or escaping. Authenticated customers can submit a backtick-quoted identifier to POST /api/v1/query that injects ...

CVE-2026-114084

Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint, which concatenates the unescaped tags query parameter into the ElectricSQL shape where clause and defeats the runtimeEnvironmentId tenant guard. Authenticated attackers holding any project API key...

CVE-2026-113740

A flaw has been found in itsourcecode Online Cake Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /deletecustomer.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been...

CVE-2026-113740 itsourcecode Online Cake Ordering System deletecustomer.php sql injection

A flaw has been found in itsourcecode Online Cake Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /deletecustomer.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been...

EUVD-2026-106925

A flaw has been found in itsourcecode Online Cake Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /deletecustomer.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been...

CVE-2026-113740

The itsourcecode Online Cake Ordering System 1.0 is vulnerable to a remote SQL injection flaw. The vulnerability exists in an unknown functionality within the /deletecustomer.php file, where manipulation of the ID argument allows for unauthorized database interaction. An exploit for this vulnerab...

CVE-2026-113740 itsourcecode Online Cake Ordering System deletecustomer.php sql injection

A flaw has been found in itsourcecode Online Cake Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /deletecustomer.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been...

CVE-2026-114099

Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGSPOST names without escaping literal dots, so distinct properties collide. Unauthenticated attackers can add a later dotted property such as account.role that overwrites a malicious nest...

CVE-2026-114099 Coraza 3.0.0 before 3.8.1 WAF Bypass via JSON Key Collision

Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGSPOST names without escaping literal dots, so distinct properties collide. Unauthenticated attackers can add a later dotted property such as account.role that overwrites a malicious nest...

EUVD-2026-106902

Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGSPOST names without escaping literal dots, so distinct properties collide. Unauthenticated attackers can add a later dotted property such as account.role that overwrites a malicious nest...

CVE-2026-114099

Coraza versions 3.0.0 before 3.8.1 are vulnerable to a WAF Bypass via a JSON Key Collision . The root cause is a JSON body processor that flattens nested properties into dot-separated ARGS_POST names without escaping literal dots, causing distinct properties to collide. Unauthenticated attackers ...