286988 matches found
CVE-2026-96604: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was identified in SoftNews Media Group DataLife Engine 18.0. This affects the function stripdata of the file engine/modules/search.php of the component Search Module. The manipulation of the argument story leads to sql injection. The attack can be initiated remotely. The exploit i...
CVE-2026-96602: Improper Neutralization of Special Elements used in an SQL Command
A flaw has been found in Abdurrab5 online-makeup-store. This impacts an unknown function of the file customerSignin.php of the component Customer Login Handler. This manipulation of the argument username/password causes sql injection. The attack is possible to be carried out remotely. The exploit...
CVE-2026-96601: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was detected in Abdurrab5 online-makeup-store. This affects an unknown function of the file index.php of the component Admin Login Handler. The manipulation of the argument id/password results in sql injection. The attack can be executed remotely. The exploit is now public and may...
PT-2026-97513
Name of the Vulnerable Software and Affected Versions Easy Store versions 1.0.0 through 3.0.0 Description Two distinct issues exist in the extension. First, the endpoint 'administrator/index.php?option=com easystore&task=media.deleteImage' fails to properly sanitize the ids parameter, which is...
PT-2026-97154
Name of the Vulnerable Software and Affected Versions jet-form-builder-stripe-gateway WordPress plugin versions prior to 1.1.0 Description An issue exists where a payment token is not properly sanitized or escaped before being used in a SQL statement. This allows unauthenticated users to perform...
PT-2026-97359
Name of the Vulnerable Software and Affected Versions Photoview versions prior to 2.4.1 Description An SQL injection issue exists in the album download route. Unauthenticated attackers can inject SQL by manipulating the album id path segment. By supplying crafted SQL expressions in the album id...
PT-2026-97514
Name of the Vulnerable Software and Affected Versions Easy Store versions 1.0.0 through 3.0.0 Description An authenticated administrator can perform a SQL Injection through the coupon bulk update task. The issue occurs because the application takes input IDs and directly concatenates them into ra...
PT-2026-97125
Name of the Vulnerable Software and Affected Versions SourceCodester Online Reviewer Management System version 1.0 Description A remote SQL injection is possible due to improper handling of the test id argument within an unknown function in the '/reviewer 0/admins/assessments/pretest/btn...
PT-2026-97146
Name of the Vulnerable Software and Affected Versions iFlytek astron-agent versions prior to reward-1575 Description A SQL injection flaw exists in the getBotList API endpoint within the console/backend/commons/src/main/resources/mapper/ChatBotMarketMapper.xml file. A remote attacker can exploit...
PT-2026-97554
Name of the Vulnerable Software and Affected Versions W4 Post List versions prior to 3.0.6 Description An improper neutralization of special elements used in an SQL command allows for Blind SQL Injection. Blind SQL Injection is a technique where an attacker asks the database true or false questio...
PT-2026-97346
Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled identifiers and administrator-supplied values directly into SQL statements. Authenticated Contao backend users with Isotope module permissions can exploit...
PT-2026-97118
Name of the Vulnerable Software and Affected Versions AdithyaYelloju Restaurant-Management-System versions up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c Description An issue exists in the Search Form component within the file admin/display menu.php. A remote attacker can trigger a SQL injection ...
PT-2026-97123
Name of the Vulnerable Software and Affected Versions ClipBucket versions 5.x through 5.5.3-182 Description An issue exists in the photo search endpoint search result.php where the query parameter is passed unsanitized into SQL WHERE and ORDER BY clauses. This allows unauthenticated attackers to...
PT-2026-97487
Editor SQL Injection in Ultimeter = 3.0.8 versions...
PT-2026-97489
Unauthenticated SQL Injection in Product Filter by WBW = 3.1.7 versions...
PT-2026-97459
Administrator SQL Injection in Email Log = 2.63 versions...
PT-2026-97445
Contributor SQL Injection in Live Copy Paste for Elementor = 1.5.10 versions...
PT-2026-97452
Contributor SQL Injection in Mollie Forms = 2.11.0 versions...
PT-2026-97401
Name of the Vulnerable Software and Affected Versions Neethuharii CafeManagement affected versions not specified Description A SQL injection flaw exists in the Login Handler component within the CafePortalLogin.php file. A remote attacker can exploit this by manipulating the uname argument,...