CVE-2026-77392 | Medium | 6.3 | 2026-08-21 | A weakness has been identified in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This impacts the function saveUser of the file /pu… |
CVE-2026-68789 | Critical | 9.9 | 2026-08-20 | Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to elevate privileges… |
CVE-2026-68782 | Critical | 9.9 | 2026-08-20 | Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to elevate privileges… |
CVE-2026-46682 | High | 8.5 | 2026-08-20 | BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton allowed authenticated moderators to inject SQL through the meetingId and user… |
CVE-2026-77025 | Medium | 6.3 | 2026-08-20 | A weakness has been identified in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /viewappointmentpending.php. This manip… |
CVE-2026-77020 | High | 7.3 | 2026-08-20 | A vulnerability was identified in CodeAstro Apartment Visitor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file pas… |
CVE-2026-77019 | High | 7.3 | 2026-08-20 | A vulnerability was determined in CodeAstro Apartment Visitor Management System 1.0. Affected is an unknown function of the file /apartment-visitor/forgotpw.ph… |
CVE-2026-76998 | High | 7.3 | 2026-08-20 | A security vulnerability has been detected in SourceCodester Simple Online Food Ordering System 1.0. The impacted element is an unknown function of the file /a… |
CVE-2026-76997 | Medium | 6.3 | 2026-08-20 | A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. The affected element is an unknown function of the file /admin/ajax.ph… |
CVE-2026-63039 | | | 2026-08-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This allows an attacker to inject the stri… |
CVE-2026-63038 | | | 2026-08-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This allows an attacker to inject arbitrar… |
CVE-2026-63037 | | | 2026-08-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This appears to allow SQL injection in the… |
CVE-2026-76996 | High | 7.3 | 2026-08-20 | A security flaw has been discovered in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/admin/view_order… |
CVE-2026-76991 | Medium | 6.3 | 2026-08-20 | A vulnerability was found in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /viewappointmentapproved.php. Performing a m… |
CVE-2026-76990 | High | 7.3 | 2026-08-20 | A vulnerability has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown functionality of the file /delete.php. Such… |
CVE-2026-76635 | High | 7.2 | 2026-08-20 | baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled ta… |
CVE-2026-74011 | High | 7.6 | 2026-08-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in revmakx InfiniteWP Client allows Blind SQL Injection.
Th… |
CVE-2026-77071 | | | 2026-08-20 | n8n before 1.123.69, 2.33.4, and 2.34.1 contains a PostgREST filter injection vulnerability in the Supabase node's Row Get Many, Delete, and Update operations… |
CVE-2026-74013 | High | 8.5 | 2026-08-20 | Subscriber SQL Injection in eShipper Commerce <= 2.16.13 versions. |
CVE-2026-73998 | High | 8.5 | 2026-08-20 | Subscriber SQL Injection in WP w3all phpBB <= 3.0.5 versions. |
CVE-2026-68566 | Critical | 9.3 | 2026-08-20 | Unauthenticated SQL Injection in BookingPress Appointment Booking Pro <= 6.0.2 versions. |
CVE-2026-66680 | Critical | 9.3 | 2026-08-20 | Unauthenticated SQL Injection in Locatoraid Store Locator <= 3.9.72 versions. |
CVE-2026-66649 | Critical | 9.3 | 2026-08-20 | Unauthenticated SQL Injection in Directory Pro <= 2.5.8 versions. |
CVE-2026-66609 | Critical | 9.3 | 2026-08-20 | Unauthenticated SQL Injection in TheGem (Elementor) <= 5.12.3 versions. |
CVE-2026-66594 | High | 8.5 | 2026-08-20 | Subscriber SQL Injection in WordPress Persistent Login <= 3.1.0 versions. |
CVE-2026-66593 | Critical | 9.3 | 2026-08-20 | Unauthenticated SQL Injection in Security & Malware scan by CleanTalk <= 2.184 versions. |
CVE-2026-66592 | Critical | 9.3 | 2026-08-20 | Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 versions. |
CVE-2025-15688 | Critical | 9.3 | 2026-08-20 | Unauthenticated SQL Injection in Capella <= 2.5.5 versions. |
CVE-2026-76785 | Medium | 6.3 | 2026-08-20 | A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System 0.1. Affected is the function Transaction::getAll of the file appli… |
CVE-2026-76783 | High | 7.3 | 2026-08-20 | A security vulnerability has been detected in DeDeCMS 53_1_UTF8. This vulnerability affects unknown code of the file /plus/advancedsearch.php. Such manipulatio… |
CVE-2026-76764 | High | 7.3 | 2026-08-20 | A flaw has been found in code-projects Employee Management System 1.0. The impacted element is an unknown function of the file /process/aprocess.php of the com… |
CVE-2026-76762 | High | 7.3 | 2026-08-20 | A vulnerability was detected in code-projects Assessment Management 1.0. The affected element is an unknown function of the file /welcome.php. The manipulation… |
CVE-2026-76364 | Medium | 6.5 | 2026-08-19 | In Splunk SOAR versions below 8.6.0, a user who holds the "Automation Engineer" Splunk SOAR role could run arbitrary Structured Query Language (SQL) statements… |
CVE-2026-76343 | Medium | 6.5 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could execute attacker-cho… |
CVE-2026-76309 | Medium | 4.3 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a low-privileged user that does not hold the "admin" or "power" Splunk roles could inje… |
CVE-2026-76574 | High | 7.3 | 2026-08-19 | A flaw has been found in code-projects Hospital Information System 1.0. The impacted element is the function User::login of the file includes/users/UsersContro… |
CVE-2026-71867 | | | 2026-08-19 | Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a single quote in a schema property… |
CVE-2026-71866 | | | 2026-08-19 | Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. From version 8.19.0 until 8.21.0, a double quote in a… |
CVE-2026-61518 | High | 8.8 | 2026-08-19 | ISPConfig contains an authenticated SQL injection vulnerability in the Remote API. The primary_id parameter passed to delete and update API methods is concaten… |
CVE-2026-49392 | Medium | 5.3 | 2026-08-19 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.6.0 until 4.14.6 and 5.0.0-beta3, DB::getFile() and DB::se… |
CVE-2026-20327 | Medium | 6.5 | 2026-08-19 | A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL… |
CVE-2026-20030 | Critical | 10.0 | 2026-08-19 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal se… |
CVE-2026-75954 | | | 2026-08-19 | Joomla Extension - cmsjunkie.com - SQL injection in trips search in J-BusinessDirectory < 6.2.3 - Search keywords and ORDER BY were concatenated into SQL. 6.2… |
CVE-2026-71176 | High | 8.8 | 2026-08-19 | Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerabi… |
CVE-2026-76240 | | | 2026-08-19 | stigmem-node 0.9.0a1 interpolates Postgres backend schema identifiers into SQL strings without defensive quoting. In the affected code path the schema value is… |
CVE-2026-76205 | High | 8.1 | 2026-08-19 | phpMyFAQ before 4.1.7 contains a SQL injection vulnerability in the glossary create and update endpoints caused by truncating an escaped string before embeddin… |
CVE-2026-74804 | | | 2026-08-19 | Joomla Extension - yootheme.com - Unauthenticated SQL injection in ItemController::element() in Zoo < 4.1.64 - The filter_type request value is interpolated in… |
CVE-2026-70422 | High | 8.1 | 2026-08-19 | Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerabi… |
CVE-2026-56088 | High | 7.1 | 2026-08-19 | Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerabi… |
CVE-2026-16019 | Critical | 9.8 | 2026-08-19 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Faydam Innovation Inc. FAYDAM Datalogger allows SQL Injec… |
CVE-2026-73391 | Critical | 9.3 | 2026-08-19 | Unauthenticated SQL Injection in Total Donations <= 2.0.5 versions. |
CVE-2026-73388 | Critical | 9.3 | 2026-08-19 | Unauthenticated SQL Injection in Nikstore Core <= 1.5 versions. |
CVE-2026-73185 | Critical | 9.3 | 2026-08-19 | Unauthenticated SQL Injection in NGG Smart Image Search < 4.0.0 versions. |
CVE-2026-73183 | Critical | 9.3 | 2026-08-19 | Unauthenticated SQL Injection in Maps Marker Pro <= 4.32 versions. |
CVE-2026-66668 | High | 8.5 | 2026-08-19 | Subscriber SQL Injection in Community by PeepSo <= 9.0.5.2 versions. |
CVE-2026-32552 | High | 8.5 | 2026-08-19 | Subscriber SQL Injection in YITH WooCommerce Membership Premium <= 2.33.0 versions. |
CVE-2026-16950 | High | 8.6 | 2026-08-19 | The Product Shortlist WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthentic… |
CVE-2026-12983 | High | 8.6 | 2026-08-19 | The Dinatur WordPress plugin through 1.18 does not sanitize and escape user input before using it in a SQL query, allowing unauthenticated users to perform SQL… |
CVE-2026-76050 | High | 7.3 | 2026-08-19 | A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This impacts an unknown function of the file /admin/ajax.php?action=delete_… |
CVE-2026-76049 | High | 7.3 | 2026-08-19 | A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affects an unknown function of the file /admin/ajax.php?action=sa… |
CVE-2026-76048 | High | 7.3 | 2026-08-19 | A flaw has been found in SourceCodester Simple Online Food Ordering System 1.0. The impacted element is an unknown function of the file /admin/ajax.php?action=… |
CVE-2026-75986 | High | 7.3 | 2026-08-19 | A vulnerability has been found in code-projects Online Job Portal System 1.0. The impacted element is an unknown function of the file /ForPass.php of the compo… |
CVE-2026-54348 | High | 7.2 | 2026-08-18 | Froxlor is open source server administration software. Prior to 2.3.8, the Admins.add and Admins.update endpoints in lib/Froxlor/Api/Commands/Admins.php accept… |
CVE-2026-75876 | Medium | 6.3 | 2026-08-18 | A security vulnerability has been detected in xianrendzw EasyReport up to 2.0.17.0522_Beta. Affected by this issue is some unknown functionality of the file Mo… |
CVE-2026-47720 | Medium | 5.3 | 2026-08-18 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the TDengine DAQ storage connector's escapeTdString function in serve… |
CVE-2026-74015 | Critical | 9.3 | 2026-08-18 | Unauthenticated SQL Injection in Readabler < 2.0.18 versions. |
CVE-2026-73392 | Critical | 9.3 | 2026-08-18 | Unauthenticated SQL Injection in Super Store Finder <= 7.8 versions. |
CVE-2026-73365 | Critical | 9.3 | 2026-08-18 | Unauthenticated SQL Injection in JetAppointment <= 2.5.2 versions. |
CVE-2026-73355 | Critical | 9.3 | 2026-08-18 | Unauthenticated SQL Injection in Affiliates Manager <= 2.9.53 versions. |
CVE-2026-73345 | High | 7.1 | 2026-08-18 | Customer SQL Injection in License Manager for WooCommerce <= 3.0.18 versions. |
CVE-2026-73339 | Critical | 9.3 | 2026-08-18 | Unauthenticated SQL Injection in Modern Events Calendar < 7.35.0 versions. |
CVE-2026-73187 | Critical | 9.3 | 2026-08-18 | Unauthenticated SQL Injection in Sticky Chat Widget <= 1.4.2 versions. |
CVE-2026-66622 | High | 7.5 | 2026-08-18 | Unauthenticated SQL Injection in Depicter Slider <= 4.8.0 versions. |
CVE-2026-32466 | High | 8.5 | 2026-08-18 | Subscriber SQL Injection in Gravity Forms Bookings premium <= 2.1 versions. |
CVE-2026-75778 | High | 7.3 | 2026-08-18 | A vulnerability was identified in code-projects Task Management System 1.0. This affects the function Operation::select_with_multiple_condition of the file /in… |
CVE-2026-75089 | High | 7.3 | 2026-08-18 | A weakness has been identified in PHPGurukul Complaint Management System 1.0. Affected by this issue is some unknown functionality of the file user/check_avail… |
CVE-2026-75088 | Medium | 6.3 | 2026-08-18 | A vulnerability was determined in itsourcecode Hospital Management System 1.0. This impacts an unknown function of the file /viewbilling.php. Executing a manip… |
CVE-2026-75087 | Medium | 6.3 | 2026-08-18 | A vulnerability was found in itsourcecode Hospital Management System 1.0. This affects an unknown function of the file /viewdepartment.php. Performing a manipu… |
CVE-2026-75086 | Medium | 6.3 | 2026-08-18 | A vulnerability has been found in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /viewroom.php. Such mani… |
CVE-2026-75080 | High | 7.3 | 2026-08-18 | A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. This issue affects some unknown processing of the file /edi… |
CVE-2026-75079 | High | 7.3 | 2026-08-18 | A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. This vulnerability affects unknown code of the file /edit_subject2.php… |
CVE-2026-67854 | Critical | 9.8 | 2026-08-17 | SQL Injection vulnerability in Qcms v.6.0.6 allows a remote attacker to execute arbitrary code |
CVE-2026-67917 | Critical | 9.8 | 2026-08-17 | zuraCast versions up to and including 0.23.7 contain a SQL injection vulnerability in the backup restore functionality. The `azuracast:restore` command execute… |
CVE-2026-65822 | High | 7.6 | 2026-08-17 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.116.0 and 16.23.0, erpnext/selling/report/inactive_customers/inactive_customer… |
CVE-2026-64657 | High | 8.4 | 2026-08-17 | Budibase is an open-source low-code platform. Prior to 3.39.19, the PostgreSQL datasource connector in packages/server/src/integrations/postgres.ts interpolate… |
CVE-2026-75014 | High | 7.3 | 2026-08-17 | A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code of the file /admin/get_barcode_data.php… |
CVE-2026-74254 | | | 2026-08-17 | Joomla Extension - joomlack.fr - SQL injection in Page Builder CK < 3.6.5 - The Joomla extension Page Builder CK is vulnerable to a SQL injection issue related… |
CVE-2026-51346 | Critical | 9.1 | 2026-08-17 | SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive inform… |
CVE-2026-50769 | Critical | 9.8 | 2026-08-17 | The CRM+ application before and including version 2025.6 from Brainformatik is vulnerable to SQL Injection (time-based) vulnerability. The check conflict endpo… |
CVE-2026-20000 | Medium | 6.3 | 2026-08-17 | A vulnerability was detected in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /viewprescriptionrecord.ph… |
CVE-2026-15623 | | | 2026-08-17 | A SQL Injection vulnerability in a legacy dashboard widget API in Google Cloud Google SecOps (Chronicle SOAR) versions prior to 6.3.85 on Google Cloud Platform… |
CVE-2026-19973 | Medium | 6.3 | 2026-08-17 | A vulnerability was found in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /viewpaymentre… |
CVE-2026-19972 | Medium | 6.3 | 2026-08-17 | A vulnerability has been found in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /viewpatient.php. Such manipulation… |
CVE-2026-74251 | | | 2026-08-16 | Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6 - The a[] (attribute) and s[] (specification) GET a… |
CVE-2026-2497 | High | 7.2 | 2026-08-16 | The Gallery by BestWebSoft plugin for WordPress is vulnerable to SQL Injection via the '_gallery_order_{post_id}' parameter array keys in all versions up to, a… |
CVE-2026-9767 | Medium | 6.5 | 2026-08-16 | The The School Management – Education & Learning ERP plugin for WordPress is vulnerable to generic SQL Injection via 'order[0][dir]' Parameter in all versions… |
CVE-2026-2283 | Medium | 4.9 | 2026-08-16 | The User Login History plugin for WordPress is vulnerable to SQL Injection via the 'blog_id' parameter in all versions up to, and including, 2.1.7. This is due… |
CVE-2026-19934 | Medium | 6.3 | 2026-08-16 | A vulnerability has been found in itsourcecode Hospital Management System 1.0. This impacts an unknown function of the file /vieworder.php. The manipulation of… |
CVE-2026-18653 | High | 7.2 | 2026-08-16 | The WP Directory Kit WordPress plugin before 1.5.7 does not sanitise and escape a parameter before using it in a SQL statement, allowing administrators to perf… |
CVE-2026-17582 | Medium | 4.9 | 2026-08-16 | The Slider Hero plugin for WordPress is vulnerable to second-order SQL Injection in versions up to, and including, 9.1.7 via the qcld_sliderhero_duplicate() fu… |