CVE-2026-101010: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in aaPanel BaoTa up to 11.8.0. The impacted element is the function getData of the file /www/server/panel/class/data.py. The manipulation of the argument logtype leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly availabl...

CVE-2026-93000: Improper Neutralization of Special Elements used in an SQL Command

The SPS-Suite WordPress plugin through 1.4.0 does not sanitise the search query before using it in a SQL query when its static-page search feature is enabled, allowing unauthenticated attackers to perform SQL injection attacks...

PT-2026-108335

DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql type cast svpv. When casting to SQL NUMERIC, sql type cast svpv passes the string pointer and length of the SV to grok number without stringifying it first. An integer IV or floating-point NV value has no valid...

PT-2026-99786

Name of the Vulnerable Software and Affected Versions aaPanel BaoTa versions prior to 11.8.1 Description A security flaw in the Domain Handler component allows for remote SQL injection. The issue exists within the get domain status function located in the...

CVE-2026-100894: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This issue affects some unknown processing of the file updateguest.php. The manipulation of the argument gname leads to sql injection. The attack may be initiated remotely. Th...

CVE-2026-100898: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/2.0.0-beta1. This affects the function whereRaw of the file app/Filament/Widgets/Timesheet/ActivitiesReport.php of the component Timesheet Dashboard. Performing a manipulation of the argument filter results in...

CVE-2026-101018: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in dayrui XunruiCMS up to 4.7.2. This issue affects the function groupalledit of the file dayrui/App/Member/Controllers/Admin/Home.php of the component Group Editing. This manipulation of the argument groupid causes sql injection. The attack is possible to be carrie...

PT-2026-99886

Name of the Vulnerable Software and Affected Versions Dayforce Payroll version R2026.2.0 Description The password recovery functionality is susceptible to Time-Based Blind SQL Injection, a technique where an attacker determines information by observing the time the server takes to respond to...

CVE-2026-89303: Improper Neutralization of Special Elements used in an SQL Command

The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to perform SQL injection attacks...

PT-2026-99797

Name of the Vulnerable Software and Affected Versions CloudClassroom-PHP-Project affected versions not specified Description A remote SQL injection is possible due to improper handling of the editid argument within an unknown function in the updateresultdetails.php file. SQL injection is a...

PT-2026-99755

Name of the Vulnerable Software and Affected Versions DevaslanPHP project-management versions 1.2.1 through 1.2.4 DevaslanPHP project-management version v2.0.0-beta1 Description A remote SQL injection exists in the Timesheet Dashboard component within the whereRaw function of the...

PT-2026-102304

Name of the Vulnerable Software and Affected Versions Vehicle Manager Free versions prior to 6.5.8 Description An unauthenticated SQL Injection exists in the site/vehiclemanager.php file. The issue occurs because the order field and order direction parameters are processed through a sanitizing...

PT-2026-99787

Name of the Vulnerable Software and Affected Versions CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be Description A remote SQL injection is possible due to improper handling of the makeid argument within an unknown function of the makeresult.php file. SQL...

PT-2026-99780

Name of the Vulnerable Software and Affected Versions SPS-Suite WordPress plugin versions prior to 1.4.1 Description An issue exists when the static-page search feature is enabled, where the plugin fails to sanitize the search query before incorporating it into a SQL query. This allows...

CVE-2026-100752: Improper Neutralization of Special Elements used in an SQL Command

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager Free 6.7.9 - site/realestatemanager.php builds the ORDER BY clause of three separate frontend property-listing queries category browsing, search results, and the full property listing from a request-controlled...

Harness Blind SQL Injection

Harness open source Gitness suffers from a registry related blind SQL injection vulnerability. https://packetstorm.news/download/233045...

PT-2026-102306

Name of the Vulnerable Software and Affected Versions Book Library Free versions prior to 6.4.6 Description An unauthenticated SQL Injection exists in the books function within the site/booklibrary.php file. The issue occurs when the function processes the field and direction request parameters...

PT-2026-99754

Name of the Vulnerable Software and Affected Versions DevaslanPHP project-management versions 1.2.1 through 1.2.4 DevaslanPHP project-management version 2.0.0-beta1 Description Remote SQL injection is possible within the Timesheet Dashboard component. The issue exists in the whereRaw function...

CVE-2026-101091: Improper Neutralization of Special Elements used in an SQL Command

SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyuan.db. Attackers can craft malicious .sy documents with non-read-only SQL statements that execute automatically during background indexing, rendering, or export operations witho...

CVE-2026-101011: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in aaPanel BaoTa up to 11.8.0. This affects the function getdomainstatus of the file /www/server/panel/mod/project/domain/domainMod.py of the component Domain Handler. The manipulation of the argument get results in sql injection. It is possible to launch the...