262675 matches found
CVE-2026-93300
The EventON - Subscriber plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.4.5 . The root cause is insufficient escaping of the 'email' parameter and a lack of proper preparation for the existing SQL query. This flaw allows unauthenticated attackers to appe...
SUSE CVE-2026-86047
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A...
PT-2026-118325
UNSUPPORTED WHEN ASSIGNED Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. Missing input sanitation would allow arbitrary SQL injection through the SQL processor or sql:/esql:...
PT-2026-118298
Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query in github.com/sipcapture/homer-app. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
PT-2026-118314
A weakness has been identified in Osclass up to 8.3.1. Affected by this vulnerability is the function Item::findUserItems of the file oc-includes/osclass/model/Item.php of the component Item Model Handler. This manipulation of the argument sPattern causes sql injection. The attack may be initiate...
PT-2026-118310
The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters of the LIKE operator are escaped, quote characters are not. A crafted search term can therefore leave the intended string value and change the database query...
PT-2026-119440
Name of the Vulnerable Software and Affected Versions Oracle Application Object Library versions 12.2.3 through 12.2.15 Description An unauthenticated attacker with network access via HTTP can compromise the Oracle Application Object Library. The issue involves an unauthenticated SQL injection...
VulnCheck KEV: CVE-2023-34545
A SQL injection vulnerability in CSZCMS 1.3.0 allows remote attackers to run arbitrary SQL commands via p parameter or the search URL...
PT-2026-118682
Name of the Vulnerable Software and Affected Versions FooSun DotNetCMS versions 1.0 through 2.0 Description An SQL injection flaw allows unauthenticated attackers to manipulate MSSQL queries. By sending GET requests to the '/user/City ajax.aspx' endpoint with UNION SELECT payloads in the CityId...
CVE-2026-112252
A vulnerability has been found in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System up to 3.5. Affected is the function xpcmdshell of the file /ws.asmx. The manipulation of the argument sql leads to sql injection. The attack may be initiated remotely...
CVE-2026-112252 Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System ws.asmx xp_cmdshell sql injection
A vulnerability has been found in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System up to 3.5. Affected is the function xpcmdshell of the file /ws.asmx. The manipulation of the argument sql leads to sql injection. The attack may be initiated remotely...
EUVD-2026-104573
A vulnerability has been found in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System up to 3.5. Affected is the function xpcmdshell of the file /ws.asmx. The manipulation of the argument sql leads to sql injection. The attack may be initiated remotely...
CVE-2026-112252
A SQL injection vulnerability exists in the Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System (versions up to 3.5). The flaw is located in the xp_cmdshell function of the /ws.asmx file, where manipulation of the sql argument allows for remote executi...
CVE-2026-107083
SENAYAN Library Management System SLiMS Bulian slims9bulian 9.8.0 is vulnerable to SQL Injection in admin/modules/reporting/customs/dldetail.php via the parameter fileID...
CVE-2026-107082
Slims Senayan Library Management Systems 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opachide and promoted GET parameters of admin/modules/bibliography/index.php, because escapestring is applied but the values are concatenated into an unquoted numeric SQL...
CVE-2026-112306
NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL through the sqlCollection:setFields action. Attackers holding the collection-sql snippet can replace a benign collection quer...
CVE-2026-112153
A vulnerability was detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This affects the function mysqlierror of the file Officers/addOfficer.php of the component Officer Registration Form. Performing a manipulation of the argument...
CVE-2026-112152
A security vulnerability has been detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected by this issue is the function mysqliquery of the file Officers/searchOff.php of the component Search Page. Such manipulation of the argument Search leads to sq...
CVE-2026-107081
SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints admin/AJAXlookuphandler.php, admin/AJAXcheckid.php, admin/AJAXvocabolarycontrol.php in SENAYAN Library Management System SLiMS Bulian 9.8.0 allows any authenticated staff user to extrac...
CVE-2026-112153
The vraj404 Criminal-Management-System is vulnerable to SQL injection within the Officer Registration Form component. Specifically, the mysqli_error function in the Officers/addOfficer.php file is affected. Attackers can initiate a remote attack by manipulating the offName/offID/ID/contact/gender...