CVE-2026-114081

The software Trigger.dev before version 4.5.6 is vulnerable to a cross-tenant SQL injection in its TSQL query compiler. The root cause is the improper concatenation of window-function names into generated ClickHouse SQL without adequate escaping or allowlisting. Authenticated customers can exploi...

CVE-2026-114081

Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without allowlisting or escaping. Authenticated customers can submit a backtick-quoted identifier to POST /api/v1/query that injects ...

PT-2026-120667

A security flaw has been discovered in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This impacts the function save user of the file admin class.php of the component User Account Management. The manipulation of the argument name/username/password/type/id...

PT-2026-120635

A vulnerability was found in itsourcecode Sales-and-Inventory-System up to 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac. The affected element is an unknown function of the file /pages/cust searchfrm.php. Performing a manipulation of the argument ID results in sql injection. The attack may be initiate...

PT-2026-120668

A weakness has been identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected is the function save folder/delete folder/delete file/file rename/save files of the file admin class.php of the component Folder Management. This manipulation of the...

PT-2026-120225

Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS POST names without escaping literal dots, so distinct properties collide. Unauthenticated attackers can add a later dotted property such as account.role that overwrites a malicious...

PT-2026-120465

The Swift Performance Lite WordPress plugin before 2.3.7.4 does not properly sanitize and escape a value before using it in a SQL statement, which could allow users with the author role and above to perform SQL injection attacks...

PT-2026-120634

A vulnerability has been found in itsourcecode Sales-and-Inventory-System up to 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac. Impacted is an unknown function of the file /pages/cust del.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit...

PT-2026-120622

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WPdreams Ajax Search Lite ajax-search-lite allows Blind SQL Injection.This issue affects Ajax Search Lite: from n/a through 4.14.6...

PT-2026-120739

A security flaw has been discovered in ProjectWorlds Advanced Library Management System 1.0. The impacted element is an unknown function of the file edit member.php. Performing a manipulation of the argument firstname/middlename/lastname/address/branch/type results in sql injection. Remote...

PT-2026-120771

A security vulnerability has been detected in ProjectWorlds Advanced Library Management System 1.0. This impacts the function mysqli query of the file profile.php. The manipulation of the argument admin id leads to sql injection. The attack is possible to be carried out remotely. The exploit has...

PT-2026-120844

A weakness has been identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/update.php. This manipulation of the argument action/full name/visa no/hiden/title/description/page id/user causes sql injection. The attack may be initiated remotely...

PT-2026-120843

A vulnerability was identified in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/delete.php. The manipulation of the argument costomer id/ticket id/payment id/id/document id/salary id/emp id/user id leads to sql injection. The attack can be initiated remotely...

PT-2026-120437

A weakness has been identified in projectworlds Advanced Library Management System 1.0. Impacted is the function mysqli query of the file report search.php. Executing a manipulation of the argument dateto/datefrom can lead to sql injection. The attack can be executed remotely. The exploit has bee...

PT-2026-120444

The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL...

PT-2026-120486

The Click n Chat Chat Widget Integration WordPress plugin before 1.1.3 does not sanitise sort parameters before using them in a SQL ORDER BY clause, allowing unauthenticated attackers to perform SQL injection attacks...

PT-2026-120485

The Click n Chat Chat Widget Integration WordPress plugin before 1.1.3 does not properly validate a parameter before using it as a column identifier in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks...

PT-2026-120644

A vulnerability was identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function Login of the file admin class.php. The manipulation of the argument username/password leads to sql injection. Remote exploitation of the attack is...

PT-2026-120669

A security vulnerability has been detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this vulnerability is the function readfile of the file download.php of the component File Download. Such manipulation of the argument ID leads to sql...

WordPress Ajax Search Lite SQL injection vulnerability

WordPress Ajax Search Lite versions 4.14.6 and earlier contain an SQL injection vulnerability. This vulnerability stems from improper handling of special elements within SQL commands, potentially leading to blind SQL injection...