CVE-2026-104609: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This affects the function get of the file editaccounts.php. This manipulation of the argument userid/patientid/physicianid/discountsid/servicesid causes sql injection. Remote...

PT-2026-104072

A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /reviewer 0/admins/assessments/activities/btn functions.php?action=activity. The manipulation of the argument Title results in sql injection...

Tenable Nessus < 10.12.5 Multiple Vulnerabilities (TNS-2026-26)

According to its self-reported version, the Tenable Nessus application running on the remote host is prior to 10.12.5. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2026-26 advisory. - Nessus did not sufficiently verify the integrity of certain downloaded content...

PT-2026-104335

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in GG Soft Software Services Inc. Paperwork allows SQL Injection. This issue affects Paperwork: through 2026-09-09...

CVE-2026-97634: Improper Neutralization of Special Elements used in an SQL Command

The Event Tickets and Registration plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.29.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2026-82039: Improper Neutralization of Special Elements used in an SQL Command

UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupService.searchQueryBuilder that allows authenticated attackers to inject arbitrary SQL by supplying malicious assetType and groupName values that are inserted unsanitized into a native PostgreSQL query via String.forma...

PT-2026-104270

YesWiki before 4.6.7 contains a blind SQL injection vulnerability in the newtextsearch action because Bazar list option ids are concatenated into SQL REGEXP/LIKE clauses in actions/newtextsearch.php without escaping. Anonymous attackers can plant a malicious option id in an anonymously editable...

PT-2026-104194

A security flaw has been discovered in itsourcecode Online Admission System Project 1.0. The impacted element is an unknown function of the file confirm.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the...

CVE-2026-104625: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in CodeAstro Simple Loan Management System 1.0. Impacted is an unknown function of the file /admin/index.php. Performing a manipulation of the argument gname results in sql injection. The attack may be initiated remotely. The exploit has been released to the...

CVE-2026-104606: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in itsourcecode Online Admission System Project 1.0. The impacted element is an unknown function of the file confirm.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the...

CVE-2026-104614: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in CodeAstro Simple Pharmacy Management System 1.0. This issue affects some unknown processing of the file /SimplePharmacy-PHP/product/delete.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit is public...

PT-2026-104064

Name of the Vulnerable Software and Affected Versions itsourcecode Pet Shop Management System version 1.0 Description A SQL injection issue exists in the admin reject completed.php file. This occurs when the ID argument is manipulated, allowing a remote attacker to execute unauthorized database...

CVE-2026-103766: Improper Neutralization of Special Elements used in an SQL Command

ClipBucket v5 through 5.5.3-197 contains an sql injection vulnerability that allows authenticated users with admanageraccess permission to inject SQL via the delete parameter in adminarea/adsmanager.php. Attackers can supply time-based blind payloads concatenated into AdsManager::DeleteAd queries...

CVE-2026-103766 ClipBucket v5 through 5.5.3-#197 SQL Injection via ads_manager.php delete Parameter

ClipBucket v5 through 5.5.3-197 contains an sql injection vulnerability that allows authenticated users with admanageraccess permission to inject SQL via the delete parameter in adminarea/adsmanager.php. Attackers can supply time-based blind payloads concatenated into AdsManager::DeleteAd queries...

CVE-2026-103766 ClipBucket v5 through 5.5.3-#197 SQL Injection via ads_manager.php delete Parameter

ClipBucket v5 through 5.5.3-197 contains an sql injection vulnerability that allows authenticated users with admanageraccess permission to inject SQL via the delete parameter in adminarea/adsmanager.php. Attackers can supply time-based blind payloads concatenated into AdsManager::DeleteAd queries...

CVE-2026-103766

ClipBucket versions v5 through 5.5.3-#197 are vulnerable to an SQL injection vulnerability. The issue resides in the admin_area/ads_manager.php file, where authenticated users with ad_manager_access permissions can inject SQL via the delete parameter . By supplying time-based blind payloads conca...

CVE-2026-103766 ClipBucket v5 through 5.5.3-#197 SQL Injection via ads_manager.php delete Parameter

ClipBucket v5 through 5.5.3-197 contains an sql injection vulnerability that allows authenticated users with admanageraccess permission to inject SQL via the delete parameter in adminarea/adsmanager.php. Attackers can supply time-based blind payloads concatenated into AdsManager::DeleteAd queries...

sqlparse: sqlparse: Denial of Service via inefficient SQL parsing

A flaw was found in sqlparse, a Python module for parsing SQL. A remote attacker could exploit this vulnerability by providing specially crafted SQL input. This flaw causes inefficient processing of certain SQL patterns, leading to excessive CPU consumption and potentially a Denial of Service DoS...

rubygem-katello: SQL injection in Registry Proxy via labels

A flaw was found in rubygem-katello. An SQL injection vulnerability exists in the Red Hat Satellite Katello Registry Proxy. The application fails to sanitize input parameters used in database queries within the RegistryProxiesController. The methods checkblobpushorglabel and...

rubygem-katello: SQL injection in Registry Proxy via labels

A flaw was found in rubygem-katello. An SQL injection vulnerability exists in the Red Hat Satellite Katello Registry Proxy. The application fails to sanitize input parameters used in database queries within the RegistryProxiesController. The methods checkblobpushorglabel and...