CVE-2026-62262: Improper Neutralization of Special Elements used in an SQL Command

Piwigo is a full featured open source photo gallery application for the web. In 17.0.0beta1 and earlier, when rating is enabled, an unauthenticated guest can call pwg.images.filteredSearch.create with a crafted ratings value and then open the returned search URL. include/wsfunctions/pwg.images.ph...

CVE-2026-97883: Improper Neutralization of Special Elements used in an SQL Command

A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This affects an unknown function of the file updatequery.php. The manipulation of the argument gid leads to sql injection. The attack can be initiated remotely. Th...

PT-2026-98376

Name of the Vulnerable Software and Affected Versions Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots versions prior to 3.0.5 Description An issue exists where authenticated users with subscriber-level access and above can perform a generic SQL Injection. This occurs due...

PT-2026-98955

Name of the Vulnerable Software and Affected Versions CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be Description A SQL injection flaw exists in the Faculty Authentication component within the loginlinkfaculty.php file. A remote attacker can exploit this by...

PT-2026-98960

Name of the Vulnerable Software and Affected Versions CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be Description A remote SQL injection exists within the Student Update Functionality component in the updatestudent.php file. The issue occurs when the eno argumen...

PT-2026-98857

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description The PESI service contains a SQL injection flaw. An authenticated attacker can exploit this issue to gain unauthorized access to sensitive information stored within the internal database...

PT-2026-98891

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 16.4.0 Description An authenticated administrator can store a crafted expression via the image order variable in the 'admin/element set ranks.php' endpoint because the application fails to enforce the sort-field...

CVE-2026-33639: Improper Neutralization of Special Elements used in an SQL Command

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane interpolates the administrator-controlled taxratedecimalplaces setting into an ALTER TABLE statement for iptaxrates in Settings::index without strict integer validation...

CVE-2026-97886: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected by this vulnerability is an unknown functionality of the file managevideos2.php. Such manipulation of the argument editassid leads to sql injection. The attack may be...

PT-2026-98875

Name of the Vulnerable Software and Affected Versions InvoicePlane versions prior to 1.7.2 Description InvoicePlane fails to perform strict integer validation on the tax rate decimal places setting, which is controlled by the administrator. This value is interpolated into an ALTER TABLE statement...

CVE-2026-42324: Improper Neutralization of Special Elements used in an SQL Command

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/elementsetranks.php stores administrator-controlled imageorder values without enforcing the existing sort-field whitelist. The stored album imageorder expression is later concatenated into ORDER BY...

Linux Distros Unpatched Vulnerability : CVE-2026-92692

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affected Sulu 2.6 and 3.0 release lines have...

CVE-2026-53629: Improper Neutralization of Special Elements used in an SQL Command

GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, an attacker with the READ right on logs can craft a URL for the history tab that injects attacker-controlled values into a database query. This permits SQL injection through the history tab endpoint. Thi...

CVE-2026-84893: Improper Neutralization of Special Elements used in an SQL Command

IBM Guardium Data Protection 12.2 is vulnerable to SQL injection in the PESI service. An authenticated attacker could exploit this vulnerability to access sensitive information in the internal database...

PT-2026-98956

Name of the Vulnerable Software and Affected Versions mathurvishal CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be Description A remote SQL injection is possible due to the improper handling of the gid argument within an unknown function in the updatequery.php...

CVE-2026-97885: Improper Neutralization of Special Elements used in an SQL Command

A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file updatefaculty.php. This manipulation of the argument fid causes sql injection. The attack may be initiated remotely. The exploit has been...

CVE-2026-54790: Improper Neutralization of Special Elements used in an SQL Command

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane stores an administrator-controlled customfieldtable value without validating it against the allowed custom-field table names. Mdlcustomfields::used later concatenates...

CVE-2026-42323: Improper Neutralization of Special Elements used in an SQL Command

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/batchmanager.php accepts administrator-controlled dimension width, height, and ratio values and filesize values from the Batch Manager filter URL without numeric validation. The URL filter parser...

PT-2026-98961

Name of the Vulnerable Software and Affected Versions CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be Description A remote SQL injection exists in the updatefaculty.php file. The issue occurs when the fid argument is manipulated, allowing an attacker to execute...

CVE-2026-44642: Improper Neutralization of Special Elements used in an SQL Command

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, checkupgradeaccessrights in admin/include/functionsupgrade.php conditionally escapes the submitted username only when the removed getmagicquotesgpc function exists, so PHP 8 and later concatenate an...