CVE-2026-113607 Configurable Reports block for Moodle before 5.3.0 Authorization Bypass via get_report_data

Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authenticated users to read restricted reports through the blockconfigurablereportsgetreportdata web service. When checkpermissions fails, the function only adds a warning and still retur...

CVE-2026-113607 Configurable Reports block for Moodle before 5.3.0 Authorization Bypass via get_report_data

Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authenticated users to read restricted reports through the blockconfigurablereportsgetreportdata web service. When checkpermissions fails, the function only adds a warning and still retur...

CVE-2026-113607

The Configurable Reports block for Moodle versions before 5.3.0 is vulnerable to an authorization bypass in the block_configurable_reports_get_report_data web service. The root cause is that when check_permissions fails, the function only issues a warning but continues to return the full report t...

CVE-2026-113607 Configurable Reports block for Moodle before 5.3.0 Authorization Bypass via get_report_data

Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authenticated users to read restricted reports through the blockconfigurablereportsgetreportdata web service. When checkpermissions fails, the function only adds a warning and still retur...

CVE-2026-113605 Stirling-PDF 2.13.2 through 3.2.0 H2 SQL Denylist Bypass via import-database

Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent that allows administrators to bypass H2 import restrictions using CREATE OR REPLACE ALIAS. Authenticated administrators can upload a crafted SQL backup to the import-database endpoint, whe...

CVE-2026-113605 Stirling-PDF 2.13.2 through 3.2.0 H2 SQL Denylist Bypass via import-database

Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent that allows administrators to bypass H2 import restrictions using CREATE OR REPLACE ALIAS. Authenticated administrators can upload a crafted SQL backup to the import-database endpoint, whe...

CVE-2026-113605

Stirling-PDF versions 2.13.2 through 3.2.0 are vulnerable to an H2 SQL Denylist Bypass within the DatabaseService.validateSqlContent() function. Due to an incomplete denylist, authenticated administrators can use the import-database endpoint to upload a crafted SQL backup. By utilizing CREATE OR ...

CVE-2026-113605 Stirling-PDF 2.13.2 through 3.2.0 H2 SQL Denylist Bypass via import-database

Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent that allows administrators to bypass H2 import restrictions using CREATE OR REPLACE ALIAS. Authenticated administrators can upload a crafted SQL backup to the import-database endpoint, whe...

Exploit for CVE-2026-93300

CVE-2026-93300 — EventON - Subscriber ≤ 1.4.5 Unauthenticated...

CVE-2026-108087

UNSUPPORTED WHEN ASSIGNED Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. Missing input sanitation would allow arbitrary SQL injection through the SQL processor or sql:/esql:...

WordPress Workreap Core plugin < 3.4.4 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Phat RiO in WordPress Plugin Workreap Core versions 3.4.4...

CVE-2026-108087 Apache Cocoon: SQL Injection

UNSUPPORTED WHEN ASSIGNED Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. Missing input sanitation would allow arbitrary SQL injection through the SQL processor or sql:/esql:...

CVE-2026-108087

The Apache Cocoon project (all versions) is susceptible to an SQL injection vulnerability due to missing input sanitation. This flaw allows for arbitrary SQL injection via the SQL processor or sql:/esql: logicsheets . Because the project is retired, the maintainer does not plan to release a fix. ...

CVE-2026-108087 Apache Cocoon: SQL Injection

UNSUPPORTED WHEN ASSIGNED Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. Missing input sanitation would allow arbitrary SQL injection through the SQL processor or sql:/esql:...

EUVD-2026-104912

UNSUPPORTED WHEN ASSIGNED Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. Missing input sanitation would allow arbitrary SQL injection through the SQL processor or sql:/esql:...

CVE-2026-108087

UNSUPPORTED WHEN ASSIGNED Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. Missing input sanitation would allow arbitrary SQL injection through the SQL processor or sql:/esql:...

CVE-2026-113381

A weakness has been identified in Osclass up to 8.3.1. Affected by this vulnerability is the function Item::findUserItems of the file oc-includes/osclass/model/Item.php of the component Item Model Handler. This manipulation of the argument sPattern causes sql injection. The attack may be initiate...

CVE-2026-112238

The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters of the LIKE operator are escaped, quote characters are not. A crafted search term can therefore leave the intended string value and change the database query...

Exploit for SQL Injection in Moodle

CVE-2026-102578 text | / |...

EUVD-2026-104877

A weakness has been identified in Osclass up to 8.3.1. Affected by this vulnerability is the function Item::findUserItems of the file oc-includes/osclass/model/Item.php of the component Item Model Handler. This manipulation of the argument sPattern causes sql injection. The attack may be initiate...