Other injection.

SourceCodester Class and Exam Timetabling System edit_schoolyr.php sql injection

• SourceCodester Class and Exam Timetabling System
• Other injection
• SQL injection

SourceCodester Class and Exam Timetabling System edit_subject.php sql injection

• SourceCodester Class and Exam Timetabling System
• Other injection
• SQL injection

zevorn rt-claw Telegram-to-AI Tool Execution Flow script.c tool_run_script_execute code injection

• zevorn rt-claw
• Other injection
• Code injection

SourceCodester Class and Exam Timetabling System edit_room1.php sql injection

• SourceCodester Class and Exam Timetabling System
• Other injection
• SQL injection

SourceCodester Class and Exam Timetabling System edit_rooma.php sql injection

• SourceCodester Class and Exam Timetabling System
• Other injection
• SQL injection

LiuMengxuan04 MiniCode mcp.ts child_process.spawn command injection

• LiuMengxuan04 MiniCode
• Other injection
• Command injection

itsourcecode Hospital Management System prescriptionrecord.php sql injection

• itsourcecode Hospital Management System
• Other injection
• SQL injection

oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code

• Other injection

<2.7.1 · fixed in 2.7.1

code-projects Hospital Bed Management System Login Form sql injection

• code-projects Hospital Bed Management System
• Other injection
• SQL injection

itsourcecode Hospital Management System prescriptionorderdetail.php sql injection

• itsourcecode Hospital Management System
• Other injection
• SQL injection

AhnLab EPP Management v1.0.14.32-6249 was discovered to contain a NoSQL injection vulnerability via the eventlog/agentEvent/list endpoint.

• Other injection

ArcadeDB: Scripting authorization gate (GHSA-48qw-824m-86pr) bypassed via SQL DEFINE FUNCTION ... LANGUAGE js

• Other injection
• Broken access control

<26.7.2 · fixed in 26.7.2

bunkerweb: Improper Input Validation and Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in BunkerWeb

• bunkerity bunkerweb
• Other injection
• CWE-20

H3C SecPath F1000-C8300 g=log_fw_nbc_mail_jsondata sql injection

• H3C SecPath F1000-C8300
• Other injection
• SQL injection

OpenWrt odhcpd/LuCI: unauthenticated DHCPv6 client can inject lease-file lines via FQDN hostname → stored XSS in the LuCI admin UI

• openwrt
• Cross-site scripting (XSS)
• Other injection

TidGi Desktop Remote Code Execution via Malicious TiddlyWiki Repository Import — Tiddler Startup Module Auto-Execution

• Other injection
• Code injection

<=0.13.0 · no fixed version yet

TsDProxy: X-Forwarded-For header injection allows IP spoofing in proxied requests to backend services

• Other injection

* · no fixed version yet

FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens the export

• Other injection

<2026.2 · fixed in 2026.2

Privilege Escalation via Improper Input Sanitization in TP-Link Archer VX1800v

• TP-Link Systems Inc. Archer VX1800v v1
• Other injection

SourceCodester Simple and Nice Shopping Cart Script userproductdeletequery.php sql injection

• SourceCodester Simple and Nice Shopping Cart Script
• Other injection
• SQL injection

HTTP response splitting in Fortinet FortiPAM and others

• Fortinet FortiPAM
• Fortinet FortiProxy
• Other injection

HTTP response splitting in Fortinet FortiOS and others

• Fortinet FortiOS
• Fortinet FortiPAM
• Other injection

code-projects Online Job Portal DeleteUser.php sql injection

• code-projects Online Job Portal
• Other injection
• SQL injection

code-projects Online Job Portal EditUser.php sql injection

• code-projects Online Job Portal
• Other injection
• SQL injection

itsourcecode Electronic Judging System add_judges.php sql injection

• itsourcecode Electronic Judging System
• Other injection
• SQL injection

SourceCodester Class and Exam Timetabling System edit_exam2.php sql injection

• SourceCodester Class and Exam Timetabling System
• Other injection
• SQL injection

CodeAstro Simple Online Leave Management System POST accept.php sql injection

• CodeAstro Simple Online Leave Management System
• Other injection
• SQL injection

CodeAstro Simple Online Leave Management System deletemp.php sql injection

• CodeAstro Simple Online Leave Management System
• Other injection
• SQL injection

Incorrect neutralisation in the PrestaShop firmware

• PrestaShop The firmware
• Other injection

SourceCodester Online Book Store System login.php sql injection

• SourceCodester Online Book Store System
• Other injection
• SQL injection

itsourcecode Hospital Management System patviewprescription.php sql injection

• itsourcecode Hospital Management System
• Other injection
• SQL injection

DedeCMS Column Management search.php code injection

• DedeCMS
• Other injection
• Code injection

CodeAstro Simple Online Leave Management System dashboard.php sql injection

• CodeAstro Simple Online Leave Management System
• Other injection
• SQL injection

Jinher OA PlanGiveOut.aspx sql injection

• Jinher OA
• Other injection
• SQL injection

Metasoft 美特软件 MetaCRM PHPRPC Remote Call rpc.jsp RPCService.query sql injection

• Metasoft 美特软件 MetaCRM
• Other injection
• SQL injection

pig-mesh Pig pig-codegen GeneratorServiceImpl.java code injection

• Pig
• Other injection
• Code injection

AojiaoZero Antaris PayPal IPN Payment ipn.php _rewardPurchase sql injection

• AojiaoZero Antaris
• Other injection
• SQL injection

sergomanov SmartHomeAdatum Login users.php sql injection

• sergomanov SmartHomeAdatum
• Other injection
• SQL injection

SonicCloudOrg sonic-agent JWT Authentication Filter ExchangeController.java code injection

• SonicCloudOrg sonic-agent
• Other injection
• Code injection

AMTT Hotel Broadband Operation System switch_status.php sql injection

• AMTT Hotel Broadband Operation System
• Other injection
• SQL injection

RafyMrX TOKO-ONLINE-ROTI add.php sql injection

• RafyMrX TOKO-ONLINE-ROTI
• Other injection
• SQL injection

RafyMrX TOKO-ONLINE-ROTI login.php sql injection

• RafyMrX TOKO-ONLINE-ROTI
• Other injection
• SQL injection

Aster Telecom Azcall HTTP sis.php sql injection

• Aster Telecom Azcall
• Other injection
• SQL injection

Trendnet TEW-635BRM IPoA WAN Connection Setup rc ipoa_test command injection

• Trendnet TEW-635BRM
• Other injection
• Command injection

IceHRM UserReport Endpoint EmployeeAttendanceReport.php sql injection

• IceHRM
• Other injection
• SQL injection

Bahmni bahmnicore Search Endpoint sql additionalParams sql injection

• bahmnicore
• Other injection
• SQL injection

Secure Headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted input

• Cross-site scripting (XSS)
• Other injection

<7.3.0 · fixed in 7.3.0

prestashop/ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE

• Other injection

>=3.0.0, <4.0.4 · fixed in 4.0.4

Logto: SAML IdP injects user-controlled profile attributes raw into signed assertions, allowing privilege escalation at relying Service Providers

• logto
• Other injection
• CWE-1395

grav-plugin-database: DSN Parameter Injection via Unsanitized Configuration Values in Connection String Construction

• grav
• Other injection

morgan vulnerable to Log Forging via unneutralized control characters in :remote-user

• Other injection

>=1.2.0, <1.11.0 · fixed in 1.11.0

PAN-OS: XML Injection Vulnerability in Large Scale VPN (LSVPN)

• Palo Alto Networks Cloud NGFW
• Palo Alto Networks PAN-OS
• Other injection

SourceCodester Simple and Nice Shopping Cart Script login.php sql injection

• SourceCodester Simple and Nice Shopping Cart Script
• Other injection
• SQL injection

LDAP Injection in PEAKUP's PassGate

• PEAKUP Technology Inc. PassGate
• Other injection

code-projects Interview Management System View.php sql injection

• code-projects Interview Management System
• Other injection
• SQL injection

code-projects Online Food Order System edit_food_items.php sql injection

• code-projects Online Food Order System
• Other injection
• SQL injection

CodeAstro Simple Online Leave Management System index.php sql injection

• CodeAstro Simple Online Leave Management System
• Other injection
• SQL injection

NATS Server: MQTT SUBSCRIBE Protocol Injection via Leaf Node/Route Forwarding allows arbitrary NATS command injection

• nats-io nats-server
• Other injection

Institution scope bypass vulnerability in custom reports

• Progress MOVEit Transfer
• Other injection

A vulnerability was found in bentoml OpenLLM 0.6.30. This affects the function async_run_command of the file src/openllm/common.py of the component Model Repository Directory Name Handler. Performi...

• Other injection
• Command injection

<=0.6.30 · no fixed version yet