Total
20765 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-27413 | 2026-06-17 | N/A | 9.3 CRITICAL | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozmoslabs Profile Builder Pro allows Blind SQL Injection.This issue affects Profile Builder Pro: from n/a before 3.14.0. | |||||
| CVE-2026-27373 | 2026-06-17 | N/A | 8.5 HIGH | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Essekia Tablesome tablesome allows Blind SQL Injection.This issue affects Tablesome: from n/a through <= 1.2.3. | |||||
| CVE-2026-27179 | 1 Mjdm | 1 Majordomo | 2026-06-17 | N/A | 8.2 HIGH |
| MajorDoMo (aka Major Domestic Module) contains an unauthenticated SQL injection vulnerability in the commands module. The commands_search.inc.php file directly interpolates the $_GET['parent'] parameter into multiple SQL queries without sanitization or parameterized queries. The commands module is loadable without authentication via the /objects/?module=commands endpoint, which includes arbitrary modules by name and calls their usual() method. Time-based blind SQL injection is exploitable using UNION SELECT SLEEP() syntax. Because MajorDoMo stores admin passwords as unsalted MD5 hashes in the users table, successful exploitation enables extraction of credentials and subsequent admin panel access. | |||||
| CVE-2026-27149 | 1 Discourse | 1 Discourse | 2026-06-17 | N/A | 6.5 MEDIUM |
| Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, SQL injection in PM tag filtering (`list_private_messages_tag`) allows bypassing tag filter conditions, potentially disclosing unauthorized private message metadata. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available. | |||||
| CVE-2026-27039 | 2026-06-17 | N/A | 8.5 HIGH | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team WZone woozone allows Blind SQL Injection.This issue affects WZone: from n/a through <= 14.0.31. | |||||
| CVE-2026-27005 | 1 Depomo | 1 Chartbrew | 2026-06-17 | N/A | 9.8 CRITICAL |
| Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.3, an unauthenticated attacker can inject arbitrary SQL into queries executed against databases connected to Chartbrew (MySQL, PostgreSQL). This allows reading, modifying, or deleting data in those databases depending on the database user's privileges. This issue has been patched in version 4.8.3. | |||||
| CVE-2026-26990 | 1 Librenms | 1 Librenms | 2026-06-17 | N/A | 8.8 HIGH |
| LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below have a Time-Based Blind SQL Injection vulnerability in address-search.inc.php via the address parameter. When a crafted subnet prefix is supplied, the prefix value is concatenated directly into an SQL query without proper parameter binding, allowing an attacker to manipulate query logic and infer database information through time-based conditional responses. This vulnerability requires authentication and is exploitable by any authenticated user. This issue has been fixedd in version 26.2.0. | |||||
| CVE-2026-26988 | 1 Librenms | 1 Librenms | 2026-06-17 | N/A | 9.1 CRITICAL |
| LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below contain an SQL Injection vulnerability in the ajax_table.php endpoint. The application fails to properly sanitize or parameterize user input when processing IPv6 address searches. Specifically, the address parameter is split into an address and a prefix, and the prefix portion is directly concatenated into the SQL query string without validation. This allows an attacker to inject arbitrary SQL commands, potentially leading to unauthorized data access or database manipulation. This issue has been fixed in version 26.2.0. | |||||
| CVE-2026-26980 | 1 Ghost | 1 Ghost | 2026-06-17 | N/A | 9.4 CRITICAL |
| Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1. | |||||
| CVE-2026-26892 | 1 Oretnom23 | 1 Simple Logistic Hub Parcel\'s Management System | 2026-06-17 | N/A | 7.2 HIGH |
| Sourcecodester Logistic Hub Parcel's Management System v1.0 is vulnerable to SQL Injection in /manage_carrier.php. | |||||
| CVE-2026-26891 | 1 Oretnom23 | 1 Simple Logistic Hub Parcel\'s Management System | 2026-06-17 | N/A | 2.7 LOW |
| Sourcecodester Logistic Hub Parcel's Management System v1.0 is vulnerable to SQL Injection in /manage_parcel_type.php. | |||||
| CVE-2026-26890 | 1 Oretnom23 | 1 Pharmacy Point Of Sale System | 2026-06-17 | N/A | 2.7 LOW |
| Sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/manage_product.php. | |||||
| CVE-2026-26889 | 1 Oretnom23 | 1 Pharmacy Point Of Sale System | 2026-06-17 | N/A | 2.7 LOW |
| Sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/manage_category.php. | |||||
| CVE-2026-26888 | 1 Oretnom23 | 1 Pharmacy Point Of Sale System | 2026-06-17 | N/A | 2.7 LOW |
| Sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/manage_stock.php. | |||||
| CVE-2026-26887 | 1 Oretnom23 | 1 Pharmacy Point Of Sale System | 2026-06-17 | N/A | 2.7 LOW |
| Sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/manage_supplier.php. | |||||
| CVE-2026-26886 | 1 Oretnom23 | 1 Simple Online Men\'s Salon Management System | 2026-06-17 | N/A | 2.7 LOW |
| Sourcecodester Online Men's Salon Management System v1.0 is vulnerable to SQL Injection in /admin/services/manage_service.php. | |||||
| CVE-2026-26885 | 1 Oretnom23 | 1 Simple Online Men\'s Salon Management System | 2026-06-17 | N/A | 2.7 LOW |
| Sourcecodester Online Men's Salon Management System v1.0 is vulnerable to SQL Injection in /classes/Master.php?f=delete_service. | |||||
| CVE-2026-26884 | 1 Oretnom23 | 1 Simple Online Men\'s Salon Management System | 2026-06-17 | N/A | 2.7 LOW |
| Sourcecodester Online Men's Salon Management System v1.0 is vulnerable to SQL Injection in /msms/admin/appointments/view_appointment.php. | |||||
| CVE-2026-26883 | 1 Oretnom23 | 1 Simple Online Men\'s Salon Management System | 2026-06-17 | N/A | 2.7 LOW |
| Sourcecodester Online Men's Salon Management System v1.0 is vulnerable to SQL Injection in /msms/classes/Master.php?f=delete_appointment. | |||||
| CVE-2026-26794 | 1 Gl-inet | 2 Ar300m16, Ar300m16 Firmware | 2026-06-17 | N/A | 8.8 HIGH |
| GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a SQL injection vulnerability via the add_group() function. This vulnerability allows attackers to execute arbitrary SQL database operations via a crafted HTTP request. | |||||