CVE-2026-93300 EventON - Subscriber <= 1.4.5 - Unauthenticated SQL Injection via 'email' Parameter

The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...

SUSE CVE-2026-86047

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A...

GO-2026-6672 Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query in github.com/sipcapture/homer-app

Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query in github.com/sipcapture/homer-app. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

PT-2026-118262

BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents...

PT-2026-118325

UNSUPPORTED WHEN ASSIGNED Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. Missing input sanitation would allow arbitrary SQL injection through the SQL processor or sql:/esql:...

PT-2026-119440

Name of the Vulnerable Software and Affected Versions Oracle Application Object Library versions 12.2.3 through 12.2.15 Description An unauthenticated SQL injection exists in the Thin Client Framework TCF servlet of the Oracle Application Object Library. An attacker with network access via HTTP c...

CVE-2015-20128: Improper Neutralization of Special Elements used in an SQL Command

FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate MSSQL queries through the CityId parameter. Attackers can send GET requests to /user/Cityajax.aspx with UNION SELECT payloads in CityId, concatenated unsanitized into the sysCi...

PT-2026-118468

Configurable Reports block for Moodle moodle-block configurablereports before 5.3.1 contains an sql injection vulnerability in report sql::prepare sql via the filter var request parameter of viewreport.php. Low-privileged users permitted to view reports using the %%FILTER VAR%% placeholder can...

VulnCheck KEV: CVE-2023-34545

A SQL injection vulnerability in CSZCMS 1.3.0 allows remote attackers to run arbitrary SQL commands via p parameter or the search URL...

PT-2026-120130

Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware component: Dictionary Repository. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Da...

PT-2026-118310

The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters of the LIKE operator are escaped, quote characters are not. A crafted search term can therefore leave the intended string value and change the database query...

PT-2026-118261

BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents...

PT-2026-118260

BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents...

Apache Cocoon SQL injection vulnerability

SQL injection vulnerabilities exist in all versions of Apache Cocoon. These vulnerabilities stem from improper input sanitization and may allow arbitrary SQL injection via the SQL processor or sql:/esql: logicsheets...

PT-2026-119145

Vulnerability in the Siebel Apps - Life Sciences product of Oracle Siebel CRM component: eDetailing. Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Siebel Apps - Life Sciences. Successfu...

PT-2026-118682

Name of the Vulnerable Software and Affected Versions FooSun DotNetCMS versions 1.0 through 2.0 Description An SQL injection flaw allows unauthenticated attackers to manipulate MSSQL queries. By sending GET requests to the '/user/City ajax.aspx' endpoint with UNION SELECT payloads in the CityId...

VulnCheck KEV: CVE-2015-20128

FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate MSSQL queries through the CityId parameter. Attackers can send GET requests to /user/Cityajax.aspx with UNION SELECT payloads in CityId, concatenated unsanitized into the sysCi...

FooSun DotNetCMS SQL injection vulnerability

FooSun DotNetCMS versions 1.0 and 2.0 contain an SQL injection vulnerability. This vulnerability arises because the CityId parameter is concatenated into the sysCity query without proper sanitization, potentially allowing unauthenticated attackers to extract database information...

PT-2026-118298

Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query in github.com/sipcapture/homer-app. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

PT-2026-118314

A weakness has been identified in Osclass up to 8.3.1. Affected by this vulnerability is the function Item::findUserItems of the file oc-includes/osclass/model/Item.php of the component Item Model Handler. This manipulation of the argument sPattern causes sql injection. The attack may be initiate...