CVE-2026-5148

CVE-2026-5148 affects YunaiV yudao-cloud (up to 2026.01). The vulnerability is in the /admin-api/system/mail-log/page path, caused by manipulation of the toMail argument that leads to SQL injection. It can be triggered remotely; a public exploit is available. The vendor was contacted early but di...

CVE-2026-5148 YunaiV yudao-cloud page sql injection

A weakness has been identified in YunaiV yudao-cloud up to 2026.01. This vulnerability affects unknown code of the file /admin-api/system/mail-log/page. This manipulation of the argument toMail causes sql injection. The attack can be initiated remotely. The exploit has been made available to the...

yudao-cloud SQL注入漏洞

Yudao-Cloud is a backend management system developed by YunaiV as an individual developer. Versions of Yudao-Cloud prior to 2026.01 contained a SQL injection vulnerability. This vulnerability stemmed from incorrect handling of parameters in files such as admin-api/system/mail-log/page, where the...

CVE-2026-5148: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in YunaiV yudao-cloud up to 2026.01. This vulnerability affects unknown code of the file /admin-api/system/mail-log/page. This manipulation of the argument toMail causes sql injection. The attack can be initiated remotely. The exploit has been made available to the...

Vulnerability of the /admin/bookings/view_booking.php script of the SourceCodester AC Repair and Services system, allowing a hacker to execute arbitrary SQL code

The vulnerability in the “/admin/bookings/viewbooking.php” script of the SourceCodester AC Repair and Services system relates to the lack of protective measures for the SQL query structure when processing the parameter “tomail=&groupid=”. Exploiting this vulnerability allows an attacker to execut...

The vulnerability in the admin/sendmailto.php script of the ZZCMS CMS system allows a hacker to execute arbitrary SQL code.

The vulnerability in the admin/sendmailto.php script of the ZZCMS CMS system relates to the lack of protection for the SQL query structure when processing the parameter tomail=&groupid=. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL code remotely...

PT-2023-2942 · Sourcecodester · Sourcecodester Ac Repair/Services System

Name of the Vulnerable Software and Affected Versions: SourceCodester AC Repair and Services System version 1.0 Description: A critical issue has been found in the system, affecting the /admin/bookings/view booking.php file. The manipulation of the id argument leads to SQL injection. This can be...

CVE-2022-40446: Improper Neutralization of Special Elements used in an SQL Command

ZZCMS 2022 was discovered to contain a SQL injection vulnerability via the component /admin/sendmailto.php?tomail=&groupid=...