CVE-2026-107083

SENAYAN Library Management System SLiMS Bulian slims9bulian 9.8.0 is vulnerable to SQL Injection in admin/modules/reporting/customs/dldetail.php via the parameter fileID...

CVE-2026-107082

Slims Senayan Library Management Systems 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opachide and promoted GET parameters of admin/modules/bibliography/index.php, because escapestring is applied but the values are concatenated into an unquoted numeric SQL...

CVE-2026-112306

NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL through the sqlCollection:setFields action. Attackers holding the collection-sql snippet can replace a benign collection quer...

CVE-2026-112152

A security vulnerability has been detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected by this issue is the function mysqliquery of the file Officers/searchOff.php of the component Search Page. Such manipulation of the argument Search leads to sq...

CVE-2026-112153

A vulnerability was detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This affects the function mysqlierror of the file Officers/addOfficer.php of the component Officer Registration Form. Performing a manipulation of the argument...

CVE-2026-107081

SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints admin/AJAXlookuphandler.php, admin/AJAXcheckid.php, admin/AJAXvocabolarycontrol.php in SENAYAN Library Management System SLiMS Bulian 9.8.0 allows any authenticated staff user to extrac...

Juan Leyva: Configurable reports block for Moodle SQL injection vulnerability

Juan Leyva’s configurable report block for Moodle versions prior to 5.3.1 has an SQL injection vulnerability. This vulnerability stems from the use of the viewreport.php function’s filtervar parameter, which allows SQL injection attacks. Low-privilege users can exploit the %JuanLeyva placeholder ...

YS-infoware BA-Workflow SQL Injection Vulnerability

YS-infoware BA-Workflow versions prior to 3.6.2.7 have a SQL injection vulnerability. This vulnerability stems from SQL injection attacks; authenticated remote attackers can inject any SQL statements, read, modify, and delete database content...

Apache Cocoon SQL injection vulnerability

SQL injection vulnerabilities exist in all versions of Apache Cocoon. These vulnerabilities stem from improper input sanitization and may allow arbitrary SQL injection via the SQL processor or sql:/esql: logicsheets...

TYPO3 File Manager SQL Injection Vulnerability

Versions of the TYPO3 File Manager prior to 3.1.3 have a SQL injection vulnerability. This vulnerability arises from the file search function, which escapes LIKE wildcards only when constructing database query conditions, but does not escape quotes. Attackers can alter the database queries with...

TYPO3 sgalinski Cookie Consent SQL Injection Vulnerability

In versions of TYPO3 sgalinski Cookie Consent from 8.0.0 to 8.1.12 and before, as well as 7.4.6 and before, there is an SQL injection vulnerability. This vulnerability arises due to the backend module for reviewing consent history not verifying the sorting, grouping, and indexing options in...

YS-infoware BA-Workflow SQL Injection Vulnerability

YS-infoware BA-Workflow versions prior to 3.6 have a SQL injection vulnerability. This vulnerability stems from SQL injection attacks, allowing authenticated remote attackers to inject arbitrary SQL statements, read, modify, and delete database content...

EventON – Subscriber SQL injection vulnerability

EventON – Subscriptions versions 1.4.5 and earlier have a SQL injection vulnerability. This vulnerability stems from insufficient escaping of the email parameters and inadequate preparation for existing SQL queries. It may allow unauthenticated attackers to append additional SQL queries to existi...

Osclass input validation vulnerability

Osclass 8.3.1 and earlier versions have a security vulnerability. This vulnerability stems from improper handling of the parameter sPattern in the Item::findUserItems function in the file oc-includes/osclass/model/Item.php. It may lead to remote SQL injection attacks...

CVE-2026-112153 vraj404 Criminal-Management-System Officer Registration Form addOfficer.php mysqli_error sql injection

A vulnerability was detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This affects the function mysqlierror of the file Officers/addOfficer.php of the component Officer Registration Form. Performing a manipulation of the argument...

EUVD-2026-104405

A vulnerability was detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This affects the function mysqlierror of the file Officers/addOfficer.php of the component Officer Registration Form. Performing a manipulation of the argument...

CVE-2026-112153 vraj404 Criminal-Management-System Officer Registration Form addOfficer.php mysqli_error sql injection

A vulnerability was detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This affects the function mysqlierror of the file Officers/addOfficer.php of the component Officer Registration Form. Performing a manipulation of the argument...

CVE-2026-112153 vraj404 Criminal-Management-System Officer Registration Form addOfficer.php mysqli_error sql injection

A vulnerability was detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This affects the function mysqlierror of the file Officers/addOfficer.php of the component Officer Registration Form. Performing a manipulation of the argument...

CVE-2026-112153

The vraj404 Criminal-Management-System is vulnerable to SQL injection within the Officer Registration Form component. Specifically, the mysqli_error function in the Officers/addOfficer.php file is affected. Attackers can initiate a remote attack by manipulating the offName/offID/ID/contact/gender...

CVE-2026-112306 NocoBase plugin-collection-sql through 2.2.28 SQL Injection via sqlCollection:setFields

NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL through the sqlCollection:setFields action. Attackers holding the collection-sql snippet can replace a benign collection quer...