287237 matches found
PT-2026-127184
A weakness has been identified in oretnom23 php-travel-agency-system. The affected element is an unknown function of the file contact insert.php of the component Contact Form Handler. This manipulation of the argument name/company/email/topic/phone/comments causes sql injection. The attack can be...
PT-2026-126305
Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox 2.20.4.2 - On store product list pages, the value of the sort-by URL parameter is retrieved using a string filter and passed directly to GridboxHelper::getBlogPosts. When the parameter does not match known sorting keys, it ...
PT-2026-127187
Summary A SQL Injection vulnerability exists in the Third Party Company update functionality of Dolibarr ERP/CRM. The localtax1 value parameter lt1 is concatenated directly into an SQL UPDATE statement in societe/class/societe.class.php at line 1672 without any escaping, type casting, or...
PT-2026-126707
A vulnerability was identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/customer detail.php of the component Admin Record Pages. The manipulation of the argument costomer id/ticket id/emp id/salary id/page id leads to sql injection. It is...
PT-2026-126704
Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary SQL...
PT-2026-126702
Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthoriz...
VulnCheck KEV: CVE-2026-95610
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in UpSolution UpSolution Core us-core allows Blind SQL Injection.This issue affects UpSolution Core: from n/a through 9.3...
PT-2026-126653
A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server, leading to cross-tenant read and write of configuration data and remote code execution as the PostgreSQL service account...
Vulnerabilities Resolved in Veeam Backup for Microsoft 365 8.6
Veeam Software Security Commitment Veeam® is committed to ensuring its products protect customers from potential risks. As part of that commitment, we operate a Vulnerability Disclosure Program VDP for all Veeam products and perform extensive internal code audits. When a vulnerability is...
Oracle E-Business Suite 12.2.15 SQL Injection
Oracle E-Business Suite versions 12.2.3 through 12.2.15 contain an unauthenticated Thin Client Framework SQL injection issue that can lead to remote code execution. The supplied Nuclei template checks the affected AppsTCFServer handshake and proxy creation response...
Oretnom23 Online Travel Agency System input validation error vulnerability
The Oretnom23 Online Travel Agency System has a security vulnerability stemming from improper handling of the customername/voucherno/empname parameters in the admin/customersearch.php file, which may lead to SQL injection...
CVE-2026-117513: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was determined in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/customersearch.php of the component Admin Search Pages. Executing a manipulation of the argument customername/voucherno/empname can lead to sql injection. The attack may...
PT-2026-126688
A vulnerability was determined in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/customer search.php of the component Admin Search Pages. Executing a manipulation of the argument customer name/voucher no/emp name can lead to sql injection. The attack...
PT-2026-126407
NVIDIA NeMo Agent Toolkit contains vulnerability where an attacker could cause a SQL injection issue. A successful exploit of this vulnerability might lead to data tampering, denial of service and information disclosure...
PT-2026-127238
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the PostgreSQL and TDS/MSSQL Channel Event Log backends cel pgsql and cel tds may permit arbitrary SQL execution when...
YesWiki SQL injection vulnerability
Versions of YesWiki prior to 4.7.0 contain an SQL injection vulnerability. This occurs because the from parameter in despam.php is escaped but placed in an INTERVAL without quotation marks. As a result, authenticated administrators may inject SQL via the from POST parameter, enabling blind readin...
CVE-2026-116828 YesWiki before 4.7.0 SQL Injection via despam.php INTERVAL operand
YesWiki before 4.7.0 contains a sql injection vulnerability in despam.php where the from parameter is escaped but placed in an unquoted INTERVAL position. Authenticated administrators can inject SQL via the from POST parameter to perform blind reads of the database including user password hashes...
CVE-2026-116828
Versions of YesWiki prior to 4.7.0 are vulnerable to a SQL injection flaw within the despam.php component. The root cause is that while the from parameter is escaped, it is placed in an unquoted INTERVAL position , allowing for exploitation. Authenticated administrators can leverage this vulnerab...
CVE-2026-116828
YesWiki before 4.7.0 contains a sql injection vulnerability in despam.php where the from parameter is escaped but placed in an unquoted INTERVAL position. Authenticated administrators can inject SQL via the from POST parameter to perform blind reads of the database including user password hashes...
CVE-2026-116828 YesWiki before 4.7.0 SQL Injection via despam.php INTERVAL operand
YesWiki before 4.7.0 contains a sql injection vulnerability in despam.php where the from parameter is escaped but placed in an unquoted INTERVAL position. Authenticated administrators can inject SQL via the from POST parameter to perform blind reads of the database including user password hashes...