287401 matches found
CVE-2026-113405 YS-infoware｜BA-Workflow - SQL Injection
BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents...
CVE-2026-113405
The software BA-Workflow , developed by YS-infoware , is vulnerable to a SQL Injection (CWE-89). This flaw allows authenticated remote attackers to execute arbitrary SQL statements, potentially resulting in the ability to read, modify, and delete database contents . No specific affected versions,...
WordPress Amelia plugin <= 2.4.11 - SQL Injection vulnerability
SQL Injection vulnerability discovered by SVO in WordPress Plugin Amelia versions = 2.4.11...
WordPress EventON - Subscriber plugin <= 1.4.5 - Unauthenticated SQL Injection vulnerability
WordPress EventON - Subscriber plugin = 1.4.5 - Unauthenticated SQL Injection vulnerability discovered by Austin Ginder in WordPress Plugin EventON - Subscriber versions = 1.4.5...
CVE-2026-93300
The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...
EUVD-2026-104799
The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...
CVE-2026-93300
The EventON - Subscriber plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.4.5 . The root cause is insufficient escaping of the 'email' parameter and a lack of proper preparation for the existing SQL query. This flaw allows unauthenticated attackers to appe...
CVE-2026-93300 EventON - Subscriber <= 1.4.5 - Unauthenticated SQL Injection via 'email' Parameter
The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...
CVE-2026-93300 EventON - Subscriber <= 1.4.5 - Unauthenticated SQL Injection via 'email' Parameter
The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...
SUSE CVE-2026-86047
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A...
GO-2026-6672 Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query in github.com/sipcapture/homer-app
Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query in github.com/sipcapture/homer-app. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
CVE-2015-20128: Improper Neutralization of Special Elements used in an SQL Command
FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate MSSQL queries through the CityId parameter. Attackers can send GET requests to /user/Cityajax.aspx with UNION SELECT payloads in CityId, concatenated unsanitized into the sysCi...
PT-2026-119440
Name of the Vulnerable Software and Affected Versions Oracle Application Object Library versions 12.2.3 through 12.2.15 Description An unauthenticated SQL injection exists in the Thin Client Framework TCF servlet of the Oracle Application Object Library. An attacker with network access via HTTP c...
PT-2026-118682
Name of the Vulnerable Software and Affected Versions FooSun DotNetCMS versions 1.0 through 2.0 Description An SQL injection flaw allows unauthenticated attackers to manipulate MSSQL queries. By sending GET requests to the '/user/City ajax.aspx' endpoint with UNION SELECT payloads in the CityId...
PT-2026-118468
Configurable Reports block for Moodle moodle-block configurablereports before 5.3.1 contains an sql injection vulnerability in report sql::prepare sql via the filter var request parameter of viewreport.php. Low-privileged users permitted to view reports using the %%FILTER VAR%% placeholder can...
PT-2026-120130
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware component: Dictionary Repository. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Da...
PT-2026-119806
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards component: Monitoring and Diagnostics SEC. Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows high privileged attacker with network access via SQL to compromise JD...
PT-2026-119157
🚨 CVE-2026-101469 Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain component: Installation Issues. The supported version that is affected is 3.6.1. Difficult to exploit vulnerability allows low privileged attacker with network access via SQL to compromise...
VulnCheck KEV: CVE-2015-20128
FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate MSSQL queries through the CityId parameter. Attackers can send GET requests to /user/Cityajax.aspx with UNION SELECT payloads in CityId, concatenated unsanitized into the sysCi...