240528 matches found
EUVD-2026-62215
A vulnerability was found in xianrendzw EasyReport up to 2.0.17.0522Beta. Affected is the function execSqlText/previewSqlText of the file DesignerController.java of the component SQL Preview Endpoint. The manipulation of the argument sqlText results in improper neutralization of special elements...
CVE-2026-75979 xianrendzw EasyReport SQL Preview Endpoint DesignerController.java previewSqlText special elements in template engine
A vulnerability was found in xianrendzw EasyReport up to 2.0.17.0522Beta. Affected is the function execSqlText/previewSqlText of the file DesignerController.java of the component SQL Preview Endpoint. The manipulation of the argument sqlText results in improper neutralization of special elements...
CVE-2026-75979 xianrendzw EasyReport SQL Preview Endpoint DesignerController.java previewSqlText special elements in template engine
A vulnerability was found in xianrendzw EasyReport up to 2.0.17.0522Beta. Affected is the function execSqlText/previewSqlText of the file DesignerController.java of the component SQL Preview Endpoint. The manipulation of the argument sqlText results in improper neutralization of special elements...
CVE-2026-75979
EasyReport ≤ 2.0.17.0522_Beta is vulnerable in DesignerController.java (execSqlText/previewSqlText functions) via the sqlText argument, causing improper neutralization of special elements in a template engine. Attack is remote with low privileges; CVSS 6.3 MEDIUM. Public PoC exists; project unres...
PT-2026-78453
Joomla Extension - cmsjunkie.com - SQL injection in trips search in J-BusinessDirectory 6.2.3 - Search keywords and ORDER BY were concatenated into SQL. 6.2.3 quotes keywords and allow-lists the sort clause...
PT-2026-78266
A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This impacts an unknown function of the file /admin/ajax.php?action=delete menu. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been mad...
PT-2026-78367
Name of the Vulnerable Software and Affected Versions Zoo versions prior to 4.1.64 Description An unauthenticated SQL injection exists in the element function of the ItemController. The issue occurs because the filter type request value and the type filter array are interpolated into the database...
PT-2026-78380
Name of the Vulnerable Software and Affected Versions Dell OpenManage Enterprise versions prior to 4.7.0 Description An Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection, allows a low privileged attacker with remote access to potentially cause...
PT-2026-78265
Name of the Vulnerable Software and Affected Versions SourceCodester Simple Online Food Ordering System version 1.0 Description Remote SQL injection is possible through the manipulation of the ID argument in the '/admin/ajax.php?action=save menu' endpoint. SQL injection is a technique where an...
PT-2026-78387
Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.7 Description An issue exists in the glossary create and update endpoints where an escaped string is truncated before being embedded in a SQL literal. Authenticated users with permissions to add or edit the...
CVE-2026-51366
Bottinelli Informatica Vedo Suite v.1.2.5 is affected by a SQL injection vulnerability in the api_vedo/chat endpoint via the utente_chat parameter. A remote, low-privilege attacker can exploit this to achieve arbitrary code execution , resulting in full compromise of confidentiality, integrity, a...
RHEL 10 : php8.4 (RHSA-2026:56969)
The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:56969 advisory. PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also...
PT-2026-78264
Name of the Vulnerable Software and Affected Versions SourceCodester Simple Online Food Ordering System version 1.0 Description A remote SQL injection flaw exists in the /admin/ajax.php?action=login endpoint. The issue occurs when the Username argument is manipulated, allowing an attacker to...
PT-2026-78332
Name of the Vulnerable Software and Affected Versions Community by PeepSo versions prior to 9.0.5.3 Description An issue exists that allows for SQL Injection, a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the...
MiracleLinux 8 : perl-DBI:1.641 (AXSA:2026-1574:01)
The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1574:01 advisory. DBI: Heap overflow when preparsing SQL statements with excessive placeholders CVE-2026-14739 DBI: Arbitrary code execution via caller-influenced...
UBUNTU-CVE-2026-23937
The Zabbix API host.get action can be exploited by authenticated users...
PT-2026-78490
Name of the Vulnerable Software and Affected Versions Cisco Crosswork affected versions not specified Description Multiple issues exist involving improper neutralization of special elements used in SQL commands, which can lead to SQL injection. SQL injection is a technique where an attacker inser...
PT-2026-78790
Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0 Description A user with the Automation Engineer role can execute arbitrary Structured Query Language SQL statements against the database. This allows for the creation, reading, updating, or deletion of all...
PT-2026-78373
Name of the Vulnerable Software and Affected Versions FAYDAM Datalogger versions 2.7.1 through 2.7.x Description Improper neutralization of special elements used in an SQL command allows for SQL injection. This occurs when the application fails to properly sanitize user-supplied data before...