PT-2026-76864

Name of the Vulnerable Software and Affected Versions Qcms version 6.0.6 Description An SQL Injection issue allows a remote attacker to execute arbitrary code. SQL Injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthoriz...

CVE-2026-51346

SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive information via the store functions...

EUVD-2026-60535

zuraCast versions up to and including 0.23.7 contain a SQL injection vulnerability in the backup restore functionality. The azuracast:restore command executes the db.sql file extracted from a backup archive without any content validation or sanitization. This allows a remote attacker to escalate...

PT-2026-76883

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. This issue affects some unknown processing of the file /edit subject1.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit...

Progress MOVEit Transfer < 2025.0.7 / 2025.1.x < 2025.1.3 Multiple Vulnerabilities

The version of Progress MOVEit Transfer installed on the remote host is prior to 2025.0.7 or 2025.1.x prior to 2025.1.3. It is, therefore, affected by multiple vulnerabilities, including: - Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer...

PT-2026-76734

SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive information via the store functions...

PT-2026-73417

Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9...

CVE-2026-51346

SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive information via the store functions...

CVE-2026-67854

SQL Injection vulnerability in Qcms v.6.0.6 allows a remote attacker to execute arbitrary code...

FreeBSD : PostgreSQL -- Multiple vulnerabilities (05d311bc-9991-11f1-bc50-6cc21735f730)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 05d311bc-9991-11f1-bc50-6cc21735f730 advisory. The PostgreSQL project reports: CVE-2026-6464: psql COPY FROM STDIN, if the copy fails before...

CVE-2026-67917

zuraCast versions up to and including 0.23.7 contain a SQL injection vulnerability in the backup restore functionality. The azuracast:restore command executes the db.sql file extracted from a backup archive without any content validation or sanitization. This allows a remote attacker to escalate...

CVE-2026-67854

SQL Injection vulnerability in Qcms v.6.0.6 allows a remote attacker to execute arbitrary code...

PT-2026-76736

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, group comments in sqlparse/engine/grouping.py repeatedly rescans comment-only statements before the MAX GROUPING TOKENS guard, causing quadratic CPU consumption through sqlparse.parse and sqlparse.formatsql, strip...

CVE-2026-50769

The CRM+ application (version 2025.6 and earlier) by Brainformatik has a time-based SQL injection flaw in its CheckConflictOfDates endpoint (index.php?module=Appointments&action=CheckConflictOfDates&ajaxSkipHeader=true), allowing unauthenticated remote attackers to execute arbitrary code. CVSS 3....

CVE-2026-67917

zuraCast versions ≤0.23.7 execute the db.sql file from a backup archive during restore without validation or sanitization, allowing SQL injection and privilege escalation. CVSS 9.8 (network, no auth). A PoC is referenced at https://github.com/luoxuanxi/SQL-Injection-PoC/tree/main/SQL-Injection-Po...

CVE-2026-67854

Qcms v6.0.6 is affected by a SQL Injection vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code. The vulnerability is rated CVSS 9.8 (Critical) with a network attack vector, low complexity, and no required privileges or user interaction, resulting in high impact ...

WordPress PayPal Pro <1.1.65 - SQL Injection

WordPress PayPal Pro plugin before 1.1.65 is susceptible to SQL injection via the 'query' parameter which allows for any unauthenticated user to perform SQL queries with the results output to a web page in JSON format. id: CVE-2020-14092 info: name: WordPress PayPal Pro 1.1.65 - SQL Injection...

XWiki Platform - SQL Injection

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an...

CVE-2026-74251

Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6 - The a attribute and s specification GET array parameters on Phoca Cart's public shop items page are concatenated raw into SQL WHERE clauses without parameterization or escaping. An...

CVE-2026-74251 Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6

Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6 - The a attribute and s specification GET array parameters on Phoca Cart's public shop items page are concatenated raw into SQL WHERE clauses without parameterization or escaping. An...