EUVD-2026-107705

A vulnerability was found in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/insert.php of the component Insertion Handler. The manipulation of the argument costomerid/paymenttype/amount/description/user/uploadimage/fullname/visano results in sql...

CVE-2026-114577 oretnom23 php-travel-agency-system Insertion insert.php sql injection

A vulnerability was found in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/insert.php of the component Insertion Handler. The manipulation of the argument costomerid/paymenttype/amount/description/user/uploadimage/fullname/visano results in sql...

CVE-2026-114664

The Frappe Framework before version 16.33.0 is vulnerable to a blind SQL injection in the frappe.desk.doctype.event.event.get_events method. The root cause is the failure to properly neutralize user-supplied input before it is included in SQL queries. Authenticated attackers can provide crafted i...

CVE-2026-114664

Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.getevents method, which fails to properly neutralize user-supplied input before including it in SQL queries. Authenticated attackers can send crafted input to getevents and infer...

EUVD-2026-107699

Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.getevents method, which fails to properly neutralize user-supplied input before including it in SQL queries. Authenticated attackers can send crafted input to getevents and infer...

CVE-2026-114664 Frappe before 16.33.0 Blind SQL Injection via get_events

Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.getevents method, which fails to properly neutralize user-supplied input before including it in SQL queries. Authenticated attackers can send crafted input to getevents and infer...

CVE-2026-114664 Frappe before 16.33.0 Blind SQL Injection via get_events

Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.getevents method, which fails to properly neutralize user-supplied input before including it in SQL queries. Authenticated attackers can send crafted input to getevents and infer...

CVE-2026-87936 amazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-134

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3.7, from 1.4.0 to 1.4.3...

CVE-2026-87936 amazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-134

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3.7, from 1.4.0 to 1.4.3...

CVE-2026-87936

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3.7, from 1.4.0 to 1.4.3...

EUVD-2026-107865

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3.7, from 1.4.0 to 1.4.3...

CVE-2026-87936 amazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-134

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3.7, from 1.4.0 to 1.4.3...

CVE-2026-87936

The Drupal amazee.ai Private AI Provider module (versions 0.0.0 to 1.3.7 and 1.4.0 to 1.4.3 ) is vulnerable to SQL Injection due to improper sanitization of filter values used to build queries in its Postgres/pgvector vector database backend. This occurs when a site uses this backend for a Search...

CVE-2026-87938 CSP log - Critical - SQL Injection - SA-CONTRIB-2026-136

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Drupal CSP log allows SQL Injection. This issue affects CSP log versions: from 0.0.0 to 1.0.2...

CVE-2026-87938

The CSP Log module for Drupal (versions 0.0.0 to 1.0.2 ) is vulnerable to SQL Injection due to insufficient sanitization of user-supplied values used in database queries. An attacker must possess an account with the Access CSP reports permission to exploit this vulnerability. Exploitation details...

CVE-2026-87938

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Drupal CSP log allows SQL Injection. This issue affects CSP log versions: from 0.0.0 to 1.0.2...

EUVD-2026-107863

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Drupal CSP log allows SQL Injection. This issue affects CSP log versions: from 0.0.0 to 1.0.2...

CVE-2026-87938 CSP log - Critical - SQL Injection - SA-CONTRIB-2026-136

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Drupal CSP log allows SQL Injection. This issue affects CSP log versions: from 0.0.0 to 1.0.2...

EUVD-2026-107574

A vulnerability was determined in itsourcecode Online Cake Ordering System 1.0. The affected element is an unknown function of the file /orderdetail.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly...

EUVD-2026-107584

A security vulnerability has been detected in itsourcecode Online Cake Ordering System 1.0. Affected is an unknown function of the file /transactionsave.php. Such manipulation of the argument del leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly...