A vulnerability was determined in itsourcecode Hospital Management System 1.0. This impacts an unknown function of the file /viewbilling.php. Executing a manipulation of the argument delid can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
A vulnerability was found in itsourcecode Hospital Management System 1.0. This affects an unknown function of the file /viewdepartment.php. Performing a manipulation of the argument delid results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.
CVE-2026-75080 is a medium severity SQL injection vulnerability in SourceCodester Class and Exam Timetabling System version 1.0. The flaw exists in the /edit_subject1.php file where the ID parameter is improperly handled, allowing remote attackers to inject SQL commands. This vulnerability has a CVSS score of 6.9 and has been publicly disclosed, though no known exploits are reported in the wild. No official patch or remediation guidance is currently available from the vendor.
CVE-2026-65822 is a high-severity SQL injection vulnerability in ERPNext, an open-source ERP tool. Versions prior to 15.116.0 and between 16.0.0 and before 16.23.0 allow an authenticated user to inject malicious SQL via an unvalidated doctype filter in specific report files. This can lead to unauthorized data extraction and database query manipulation. The issue is fixed in versions 15.116.0 and 16.23.0.
The Joomla extension Page Builder CK versions up to 3.6.4 are vulnerable to an SQL injection flaw affecting the styles model. This vulnerability allows an attacker to execute arbitrary SQL commands due to improper neutralization of special elements in SQL queries. The issue was fixed in version 3.6.5 for the backend and in 3.6.4 for the frontend.
A vulnerability was detected in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /viewprescriptionrecord.php. The manipulation of the argument delid results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used.
CVE-2026-15623 is a critical SQL Injection vulnerability in a legacy dashboard widget API of Google Cloud Google SecOps (Chronicle SOAR) versions prior to 6.3.85. It allows an authenticated attacker to execute blind SQL queries by sending crafted request parameters. The vulnerability has been patched in version 6.3.85, and no customer action is required as the vendor manages remediation for this cloud service.
An unauthenticated SQL injection vulnerability exists in the Phoca Cart extension for Joomla versions 5.0.0 through 6.1.16. The vulnerability arises from the a[] (attribute) and s[] (specification) GET parameters being concatenated directly into SQL WHERE clauses without proper parameterization or escaping. This flaw allows attackers to perform time-based blind SQL injection attacks to extract the full database.
The Gallery by BestWebSoft plugin for WordPress is vulnerable to SQL Injection via the '_gallery_order_{post_id}' parameter array keys in all versions up to, and including, 4.7.9. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The `gllr_save_postdata()` function stores unsanitized array keys from `$_POST` directly into post meta, which are later used in SQL queries without prepared statements. This makes it possible for authenticated attackers, with Editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
The WP Directory Kit WordPress plugin before 1.5.7 does not sanitise and escape a parameter before using it in a SQL statement, allowing administrators to perform SQL injection attacks. On a multisite installation this lets an administrator of a single site read data belonging to the entire network, which they are not otherwise able to reach.
The WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress is vulnerable to generic SQL Injection via the 'status' parameter in all versions up to, and including, 2.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with shop manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The sanitize_text_field callback strips HTML but leaves SQL metacharacters intact, and wp_magic_quotes slash protection does not apply because WP_REST_Server::serve_request() calls wp_unslash() on GET parameters before the sanitize callback executes.
The The School Management – Education & Learning ERP plugin for WordPress is vulnerable to generic SQL Injection via 'order[0][dir]' Parameter in all versions up to, and including, 5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This vulnerability is replicated across seven or more AJAX handlers including wlsm-fetch-staff-classes, wlsm-fetch-notices, wlsm-fetch-subjects, wlsm-fetch-inquiries, wlsm-fetch-staff-employee, and wlsm-fetch-payments, and the missing nonce verification on several of these handlers also enables CSRF-chained exploitation.
The Slider Hero plugin for WordPress is vulnerable to second-order SQL Injection in versions up to, and including, 9.1.7 via the qcld_sliderhero_duplicate() function. Slide data (description, title, btn, btn2, image_link, custom, etc.) is stored safely via $wpdb->update() with %s placeholders in the qchero_save_image AJAX handler, but when an administrator triggers the 'heroduplicateslider' task, qcld_sliderhero_duplicate() re-reads every slide column and concatenates the raw values directly into an INSERT VALUES tuple that is then executed with $wpdb->query() — with no $wpdb->prepare(), esc_sql(), or _real_escape_string in between. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
The User Login History plugin for WordPress is vulnerable to SQL Injection via the 'blog_id' parameter in all versions up to, and including, 2.1.7. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is only exploitable on multisite installations.