EUVD-2026-107574

A vulnerability was determined in itsourcecode Online Cake Ordering System 1.0. The affected element is an unknown function of the file /orderdetail.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly...

EUVD-2026-107665

A weakness has been identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/update.php. This manipulation of the argument action/fullname/visano/hiden/title/description/pageid/user causes sql injection. The attack may be initiated remotely. T...

EUVD-2026-107667

A vulnerability was identified in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/delete.php. The manipulation of the argument costomerid/ticketid/paymentid/id/documentid/salaryid/empid/userid leads to sql injection. The attack can be initiated remotely. The...

Security Advisory 0199

Security Advisory 0199 . CSAF PDF Date: October 22, 2026 Revision | Date | Changes ---|---|--- 1.0 | October 22, 2026 | Initial release The CVE-ID tracking this issue: CVE-2026-114625 CVSSv3.1 Base Score: 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSSv4.0 Base Score: 9.4...

NocoBase 2.0.60 SQL Injection

NocoBase versions prior to 2.0.61 contain an SQL injection vulnerability in the in-app message notification filter. The supplied proof of concept registers a user, authenticates, and submits a time-based SQL injection probe to the affected endpoint. https://packetstorm.news/download/237002...

PT-2026-121356

Name of the Vulnerable Software and Affected Versions Weaver E-cology versions 8.0 through 10.0 prior to 10.76 Description An unauthenticated SQL injection exists in the '/api/doc/out/more/list' endpoint. This occurs when the elementmore parameter is used with srcType=2, allowing attackers to...

i-Netsolution Readymade Unilevel Ecommerce MLM SQL injection vulnerability

The i-netsolution Readymade Unilevel Ecommerce MLM version for 2024-03-15 contains an SQL injection vulnerability. This flaw stems from improper input validation of the id parameter in /product-details.php. Unauthorized attackers can exploit this by sending boolean, stack-based, or time-based SLE...

PT-2026-121380

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in AmentoTech Workreap Core workreap core allows Blind SQL Injection.This issue affects Workreap Core: from n/a before 3.4.4...

PT-2026-122424

mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector stores/databricks.py that allows attackers to inject SQL by influencing stored memory content. Attackers can supply crafted memory text, metadata, or message names that reach unescaped insert and update string...

PT-2026-120960

A vulnerability was found in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/insert.php of the component Insertion Handler. The manipulation of the argument costomer id/payment type/amount/description/user/uploadimage/full name/visa no results in sql...

CVE-2019-25778: Improper Neutralization of Special Elements used in an SQL Command

SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist array parameter. Attackers can send GET requests to /comment/api/index.php with crafted rlist values using backtick-quoted...

CVE-2024-58393: Improper Neutralization of Special Elements used in an SQL Command

i-Netsolution Readymade Unilevel Ecommerce MLM 2024-03-15 build contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries through the 'id' parameter. Attackers can send GET requests to /product-details.php with boolean-based, stacked, or time-bas...

Ricardo Olsen {json:scada} SQL injection vulnerability

Ricardo Olsen json:scada Versions prior to 0.65-alpha contain an SQL injection vulnerability. This vulnerability stems from improper handling of the HistoryReadRequest parameter NodeId.Id, StartTime, and EndTime within the opcApi function in src/serverrealtimeauth/index.js. Authenticated users ca...

CVE-2022-51023: Improper Neutralization of Special Elements used in an SQL Command

PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameter. Attackers can send GET requests to /api.php?c=project&f=index with extractvalue payloads in sort to extract database information throug...

PT-2026-121293

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.11...

PT-2026-125753

Уязвимость локально развёртываемой версии оркестратора VeloCloud Orchestrator VCO On-Prem платформы управления программно-конфигурируемыми сетями VMware SD-WAN by VeloCloud связана с непринятием мер по защите структуры запроса SQL. Эксплуатация уязвимости может позволить нарушителю, действующему...

PT-2026-121593

Name of the Vulnerable Software and Affected Versions AOS-10 affected versions not specified Description A flaw in the affected interface of AOS-10 allows an unauthenticated remote attacker to perform SQL injection attacks. SQL injection is a technique where malicious SQL statements are inserted...

Weaver E-cology SQL injection vulnerability

Weaver E-cology versions 8.0, 9.0, and 10.0 prior to 10.76 contain an SQL injection vulnerability. This vulnerability allows unauthenticated attackers to perform SQL injection on the /api/doc/out/more/list endpoint via the elementmore parameter srcType=2. They can then inject SQL statements using...

PT-2026-121339

SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist array parameter. Attackers can send GET requests to /comment/api/index.php with crafted rlist values using backtick-quoted...

PT-2026-121347

NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by supplying an array-form 'id' parameter to /wp-json/notificationx/v1/notification/id. Attackers can pass id1 with crafted SQ...