EUVD-2026-63677

BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton allowed authenticated moderators to inject SQL through the meetingId and userId values used by refreshBreakoutRoomsVisibleForUsers in akka-bbb-apps/src/main/scala/org/bigbluebutton/core/db/BreakoutRoomUserDAO.scala...

Fleet: ORDER BY column injection on activity list endpoints

Summary An authenticated user with read access to Activity could influence the ORDER BY clause of the activity list endpoints by supplying an arbitrary sort column: - GET /api/v1/fleet/activities ListActivities - GET /api/v1/fleet/hosts/id/activities ListHostPastActivities This originated from th...

GHSA-7Q96-F8XW-JV5J Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database

Summary A SQL injection vulnerability in Fleet's Okta conditional access integration could allow an attacker who controls a single enrolled host to read or modify arbitrary data in the Fleet database, including stored session tokens. Disclosed session tokens may be replayed to act as a global...

Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database

Summary A SQL injection vulnerability in Fleet's Okta conditional access integration could allow an attacker who controls a single enrolled host to read or modify arbitrary data in the Fleet database, including stored session tokens. Disclosed session tokens may be replayed to act as a global...

php:8.3 security, bug fix, and enhancement update

An update is available for module.php-pecl-redis6, php, module.php-pecl-rrd, php-pecl-apcu, module.php-pecl-apcu, php-pecl-zip, php-pecl-rrd, module.php, module.php-pecl-zip, php-pecl-redis6, php-pecl-xdebug3, module.php-pecl-xdebug3. This update affects Rocky Linux 9. A Common Vulnerability...

RLSA-2026:57539 Important: php:8.3 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archives CVE-2026-7260 Bug Fixes and Enhancements...

CVE-2026-77025

A weakness has been identified in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /viewappointmentpending.php. This manipulation of the argument delid causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available...

CVE-2026-55642

dbx is a cross-platform database client for databases. Prior to 0.5.51, dbx-web authmiddleware in crates/dbx-web/src/auth.rs passes every protected request to the handler chain when passwordhash is None. A fresh deployment reaches that state when DBXPASSWORD is unset and no stored password exists...

EUVD-2026-63485

A weakness has been identified in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /viewappointmentpending.php. This manipulation of the argument delid causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available...

CVE-2026-77025 itsourcecode Hospital Management System viewappointmentpending.php sql injection

A weakness has been identified in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /viewappointmentpending.php. This manipulation of the argument delid causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available...

CVE-2026-55642

In dbx-web before 0.5.51, auth_middleware in crates/dbx-web/src/auth.rs bypasses authentication when password_hash is None, which occurs on fresh deployments with DBX_PASSWORD unset. The service binds to 0.0.0.0:4224 by default, allowing unauthenticated attackers to call /api/connection/connect a...

EUVD-2026-63470

dbx is a cross-platform database client for databases. Prior to 0.5.51, dbx-web authmiddleware in crates/dbx-web/src/auth.rs passes every protected request to the handler chain when passwordhash is None. A fresh deployment reaches that state when DBXPASSWORD is unset and no stored password exists...

CVE-2026-55642 dbx: Unauthenticated arbitrary SQL execution in dbx-web (authentication fails open when no password is configured)

dbx is a cross-platform database client for databases. Prior to 0.5.51, dbx-web authmiddleware in crates/dbx-web/src/auth.rs passes every protected request to the handler chain when passwordhash is None. A fresh deployment reaches that state when DBXPASSWORD is unset and no stored password exists...

EUVD-2026-63466

A vulnerability was identified in CodeAstro Apartment Visitor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file password-recovery.php. The manipulation of the argument email leads to sql injection. Remote exploitation of the attack is possible. The...

CVE-2026-77020

CodeAstro Apartment Visitor Management System 1.0 is vulnerable to SQL injection via the email argument in password-recovery.php. Exploitation requires no authentication and is possible over the network; a proof-of-concept exploit is publicly available. No patch version or vendor fix is provided ...

CVE-2026-63038

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This allows an attacker to inject arbitrary SQL code through the dbName, tableName, schemaName, and username parameters. This issue affects Apache InLong: from 2.0.0 before 2.4.0...

CVE-2026-63037

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This appears to allow SQL injection in the ORDER BY clause against the Manager backend database. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgra...

CVE-2026-63039

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This allows an attacker to inject the string value into the SQL statement, enabling SQL injection. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to...

EUVD-2026-63421

A vulnerability was determined in CodeAstro Apartment Visitor Management System 1.0. Affected is an unknown function of the file /apartment-visitor/forgotpw.php. Executing a manipulation of the argument secode can lead to sql injection. The attack may be launched remotely. The exploit has been...

CVE-2026-77019

CodeAstro Apartment Visitor Management System 1.0 has a SQL injection in /apartment-visitor/forgotpw.php via the secode argument, exploitable remotely without authentication (CVSS 7.5 HIGH). A proof-of-concept exploit is publicly disclosed; no patch version is provided. Exploitation details are n...