Other injection.

Cronicle: Privilege Escalation via Arbitrary Environment Variable Injection through Event Params (Incomplete Fix for CVE-2026-39401)

• jhuckaby Cronicle
• Other injection
• Broken access control

SuiteCRM: Time-Based Blind SQL Injection via AOR_Reports ORDER BY Clause Allows Data Exfiltration by Any Authenticated User

• SuiteCRM
• SQL injection
• Other injection

SuiteCRM: Authenticated SQL Injection in v4_1 get_entry_list rest api

• SuiteCRM
• SQL injection
• Other injection

mpv 0.29.0 before 0.42.0 Playlist Entry Injection via ytdl_hook Newlines

• mpv
• Other injection

itsourcecode Online Book Store admin_edit.php sql injection

• itsourcecode Online Book Store
• Other injection
• SQL injection

Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization

• Apache Software Foundation Apache Sling Engine
• Other injection

Apache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request data

• Apache Software Foundation Apache Juneau
• Other injection

eosphoros-ai DB-GPT CodeAction code_utils.py execute_code code injection

• eosphoros-ai DB-GPT
• Other injection
• Code injection

itsourcecode Airline Reservation System manage_booked.php sql injection

• itsourcecode Airline Reservation System
• Other injection
• SQL injection

Edimax BR-6208AC mp command injection

• Edimax BR-6208AC
• Other injection
• Command injection

Campcodes Complete Sales and Inventory System with Credit Management login.php sql injection

• Campcodes Complete Sales and Inventory System with Credit Management
• Other injection
• SQL injection

Campcodes Division Regional Athletic Meet Game Result Matrix System check-user.php sql injection

• Campcodes Division Regional Athletic Meet Game Result Matrix System
• Other injection
• SQL injection

krupalshah EmployeeRecruitmentSystem Requirement Board Update reqformprocessing.php mysql_query sql injection

• krupalshah EmployeeRecruitmentSystem
• Other injection
• SQL injection

NPC-Worldwide npcpy sft.py load_sft_model code injection

• NPC-Worldwide npcpy
• Other injection
• Code injection

Multiple vulnerabilities that affects IBM Db2 Genius Hub

• IBM Db2 Genius Hub
• Other injection

IBM MQ Managed File Transfer is affected by an arbitrary code execution vulnerability

• IBM MQ
• Other injection

zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 CRLF Header Injection via Message Builders

• zbateson mail-mime-parser
• Other injection

Multiple vulnerabilities in Coupa’s Total Spend Management Platform

• Coupa Total Spend Management Platform
• Other injection

LDAP wildcard injection exposes GINA recipient accounts

• SEPPmail AG SEPPmail Secure Email Gateway (SEG)
• Other injection

funadmin Frontend List Endpoint index selectList sql injection

• funadmin
• Other injection
• SQL injection

CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in multipart_start and do_push

• Other injection

Tanium addressed an improper output sanitization vulnerability in Discover.

• Tanium Discover
• Other injection

sumiie24 School-Management-System Public Search Feature parent_Login.php sql injection

• sumiie24 School-Management-System
• Other injection
• SQL injection

Effect: Cookie attribute injection via domain, path, and name fields in @effect/platform makeCookie()

• effect
• @effect platform
• Other injection

mathurvishal CloudClassroom-PHP-Project facultydetails.php sql injection

• mathurvishal CloudClassroom-PHP-Project
• Other injection
• SQL injection

EF Core provider: pipeline-form ExecuteUpdate evaluates a user string setter as a $-field reference

• MongoDB Entity Framework Core Provider
• Other injection

Yeti: Authenticated AQL injection via unvalidated search sorting and filter_aliases parameters

• yeti
• Other injection

OPNsense: Configuration line injection via multiple GUI text fields

• opnsense core
• Other injection

Potential log injection via unescaped geometry form values

• Django
• Other injection

Ziroom ZHOME A0101 Lua zrUsb.lua loadstring code injection

• Ziroom ZHOME A0101
• Other injection
• Code injection

AzuraCast before 0.24.0 Stored CSV Formula Injection via Bulk Media Export

• AzuraCast
• Other injection

AzuraCast before 0.24.0 CRLF Injection via Mount display_name in PLS Playlist

• AzuraCast
• Other injection

Apache HertzBeat: incomplete XPath expression validation in aliasFields

• Apache Software Foundation Apache HertzBeat
• Other injection

TYPO3-EXT-SA-2026-037: Broken Access Control in extension "Mail" (mail)

• Other injection

<3.12.5 || >=4.0.0, <4.2.0 · fixed in 3.12.5, 4.2.0

dayrui XunRuiCMS Mobile Site Directory index.php str_replace code injection

• dayrui XunRuiCMS
• Other injection
• Code injection

dayrui XunRuiCMS Email Template Rendering Notice.php _get_tpl_content code injection

• dayrui XunRuiCMS
• Other injection
• Code injection

dayrui XunRuiCMS Member View.php View sql injection

• dayrui XunRuiCMS
• Other injection
• SQL injection

mathurvishal CloudClassroom-PHP-Project viewquery.php sql injection

• mathurvishal CloudClassroom-PHP-Project
• Other injection
• SQL injection

beecue FastBee Groovy Script Executor script code injection

• beecue FastBee
• Other injection
• Code injection

HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI

• Other injection

WAVLINK WL-WN530BE1-A protocol.csp con_check_read_finish command injection

• WAVLINK WL-WN530BE1-A
• Other injection
• Command injection

Jpom 2.10.0 through 2.11.12 Authentication Bypass via JPOM-USER-TOKEN Header

• dromara Jpom
• Other injection

AdminNeo SQLite: multi_query Incorrect Check of Function Return Value RCE

• Other injection

<5.5.1 · fixed in 5.5.1

AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers

• Other injection
• CWE-20

>=4.6.0, <5.5.1 · fixed in 5.5.1

37954679 cak-filemanagement-system save_student.php mysqli_query sql injection

• 37954679 cak-filemanagement-system
• Other injection
• SQL injection

Injection in Dell OpenManage Enterprise

• Dell OpenManage Enterprise
• Other injection

CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name

• Other injection

OPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge Fields

• opnsense core
• Other injection

OPNsense before 26.7.8 Wireless WPA Configuration Line Injection via Identity

• opnsense core
• Other injection

OPNsense core before 26.7.8 Lockout IP Planting via WebGUI Login Username

• opnsense core
• Other injection

CakePHP through 5.4.3 MIME Header Injection via FormDataPart Content-Type

• cakephp
• Other injection

Formidable Forms <= 6.35 - Authenticated (Subscriber+) Arbitrary Plugin Installation via 'file_url' Parameter

• strategy11team Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
• Other injection

Contact Form by Supsystic < 1.11.1 - Unauthenticated CRLF / Email Header Injection via Reply-To Field Mapping

• Contact Form by Supsystic
• Other injection

OpenCATS: Authenticated Remote Code Execution via SettingsUI (manageProfessional)

• OpenCATS
• Other injection
• Code injection

Waline login accepts a non-string email as a match-all MongoDB query

• Authentication bypass
• Other injection

<1.41.0 · fixed in 1.41.0

i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string

• Other injection

<4.0.4 · fixed in 4.0.4

i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf)

• Other injection

<4.0.3 · fixed in 4.0.3

n8n before 1.123.85, 2.43.5, and 2.44.1 Filter Injection via Quick Base Node Where Parameter

• n8n
• Other injection

n8n before 1.123.85, 2.43.5, and 2.44.1 OData $filter Injection via Outlook and SharePoint Nodes

• n8n
• Other injection

NoSQL injection via mismatched BSON size prefix in raw document splice to the wire protocol

• MongoDB Java Driver
• Other injection