288244 matches found
CVE-2026-108926 itsourcecode Baptism Information Management System ebaptism.php sql injection
A security flaw has been discovered in itsourcecode Baptism Information Management System 1.0. This affects an unknown part of the file ebaptism.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit has been released to the public...
CVE-2026-63030
CVE-2026-63030 WordPress REST API batch route confusion + SQL injection leading to unauthorized admin creation → Remote Code Execution RCE complete exploit chain PoC. For authorized security testing, vulnerability reproduction, and research only. Do not use against unauthorized targets...
CVE-2026-109353
LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued notificationid parameter to notifications.inc.php. Attackers can perform cross-table reads of users.password hashes, with results persisted in...
CVE-2026-109334
SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level system user authenticated, allowing cross-tenant access. An authenticated attacker can set the Surreal-NS/Surreal-DB headers on /sql or call the RPC use method...
CVE-2026-108900
A vulnerability has been found in Exponent CMS up to 3.0.2patch2. Affected is the function userLogin of the file xmlrpc.php of the component XML-RPC. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be use...
CVE-2026-109353 LibreNMS before 26.9.0 SQL Injection via notification_id in notifications.inc.php
LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued notificationid parameter to notifications.inc.php. Attackers can perform cross-table reads of users.password hashes, with results persisted in...
CVE-2026-109353 LibreNMS before 26.9.0 SQL Injection via notification_id in notifications.inc.php
LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued notificationid parameter to notifications.inc.php. Attackers can perform cross-table reads of users.password hashes, with results persisted in...
CVE-2026-109353
LibreNMS versions before 26.9.0 are vulnerable to an SQL injection flaw within the notifications.inc.php component. This vulnerability allows unprivileged users to inject SQL by supplying an array-valued notification_id parameter . Successful exploitation enables attackers to perform cross-table ...
CVE-2026-109353 LibreNMS before 26.9.0 SQL Injection via notification_id in notifications.inc.php
LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued notificationid parameter to notifications.inc.php. Attackers can perform cross-table reads of users.password hashes, with results persisted in...
CVE-2026-109353
LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued notificationid parameter to notifications.inc.php. Attackers can perform cross-table reads of users.password hashes, with results persisted in...
EUVD-2026-97655
LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued notificationid parameter to notifications.inc.php. Attackers can perform cross-table reads of users.password hashes, with results persisted in...
CVE-2026-109334 SurrealDB before 3.3.0 Cross-Tenant Access via Surreal-NS/Surreal-DB Headers and RPC use
SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level system user authenticated, allowing cross-tenant access. An authenticated attacker can set the Surreal-NS/Surreal-DB headers on /sql or call the RPC use method...
EUVD-2026-97636
SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level system user authenticated, allowing cross-tenant access. An authenticated attacker can set the Surreal-NS/Surreal-DB headers on /sql or call the RPC use method...
CVE-2026-109334
SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level system user authenticated, allowing cross-tenant access. An authenticated attacker can set the Surreal-NS/Surreal-DB headers on /sql or call the RPC use method...
Microsoft SQL Server resource management error vulnerabilities
Microsoft SQL Server has a resource management vulnerability that arises from insufficient or ineffective restrictions on resource allocation. This vulnerability could allow authorized attackers to cause denial-of-service attacks through the network...
Siemens RUGGEDCOM CROSSBOW SQL injection vulnerability
Siemens RUGGEDCOM CROSSBOW versions prior to V6.0 have a SQL injection vulnerability. This vulnerability stems from the improper validation or cleaning of input for device groups or facility names during the Bulk Export workflow. It may allow authenticated attackers with specific privileges to...
Payload CMS SQL injection vulnerability
Payload CMS versions prior to 3.90.0 and 4.0.0-canary.0 through 4.0.0-canary.34 contain an SQL injection vulnerability. This vulnerability stems from improper handling of the “in” and “notin” query parameters provided by users, which may allow authenticated attackers to execute SQL injection...
Siemens RUGGEDCOM CROSSBOW SQL injection vulnerability
Siemens RUGGEDCOM CROSSBOW versions prior to V6.0 have a SQL injection vulnerability. This vulnerability arises from improper validation or cleaning of the input values for the Name and Value fields of custom file tags. This allows attackers with authenticated and administrator privileges to...
Ravi Teja Online-Examination-System Input Verification Error Vulnerability
Ravi Teja Online-Examination-System has a security vulnerability. This vulnerability stems from incorrect handling of the branch parameter in the include/database.php file, which may lead to SQL injection attacks...
Siemens RUGGEDCOM CROSSBOW SQL injection vulnerability
Siemens RUGGEDCOM CROSSBOW versions prior to V6.0 have a SQL injection vulnerability. This vulnerability stems from improper validation or cleaning of the filename of the uploaded firmware. It may allow authenticated attackers with specific privileges to execute arbitrary SQL commands on the...