CVE-2018-25379

Collectric CMU 1.0 SQL Injection via lang Parameter

Collectric CMU 1.0 contains a boolean-based blind SQL injection vulnerability in the lang parameter that allows unauthenticated attackers to manipulate database queries during authentication. Attackers can inject SQL code through the lang parameter in login requests to extract sensitive information from the database using time-based blind techniques.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Ourenergy

Products

Collectric Cmu

CVE-2026-9606

itsourcecode Courier Management System manage_user.php sql injection

A vulnerability has been found in itsourcecode Courier Management System 1.0. Impacted is an unknown function of the file /manage_user.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Itsourcecode

Products

Courier Management System

CVE-2026-9584

code-projects Project Management System Login chk.php sql injection

A security vulnerability has been detected in code-projects Project Management System 1.0. Affected is an unknown function of the file chk.php of the component Login. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Code-projects

Products

Product Management System Project Management System

CVE-2026-46624

Twenty: SQL Injection via the timeZone field

Twenty is an open source CRM. From 1.7.7 through 1.16.7, a critical Remote Code Execution (RCE) vulnerability exists in Twenty CRM via a chained SQL Injection and PostgreSQL COPY TO PROGRAM attack. If Postgres user is a super user then any authenticated user can execute arbitrary OS commands on the database server by injecting SQL through the unsanitized timeZone parameter in the REST API groupBy endpoint. The timeZone field within the group_by query parameter is directly interpolated into a raw SQL expression using JavaScript template literals without any parameterization, validation, or escaping. This affects engine/api/graphql/graphql-query-runner/group-by/resolvers/utils/get-group-by-expression.util.ts.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Twenty

Products

Twenty

CVE-2026-9575

itsourcecode Student Transcript Processing System index.php sql injection

A vulnerability has been found in itsourcecode Student Transcript Processing System 1.0. This issue affects some unknown processing of the file /admin/modules/class/index.php?view=view. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Itsourcecode

Products

Student Transcript Processing System

CVE-2026-40819

Unauthenticated SQLi in sync_data24 task

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the sync_data24 task due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line

Products

Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more

CVE-2026-40843

Authenticated SQLi in alarming view

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the alarming view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line

Products

Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more

CVE-2026-35221

Joomla! Core - [20260506] - Authenticated blind SQLi in com_finder

Improperly built filter clauses lead to a SQL injection vulnerability in the search query for com_finder.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Joomla

Products

Joomla! Joomla\!

CVE-2026-40848

Authenticated SQLi in tag view

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the tag view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line

Products

Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more

CVE-2026-40828

Authenticated SQLi in DeleteSysLogEntry function

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the DeleteSysLogEntry function due to improper neutralization of special elements in a SQL DELETE command allowing for reading the whole database and deleting entries in a non critical table. This can result in a total loss of confidentiality and some loss of integrity.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line

Products

Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more

CVE-2026-40832

Authenticated SQLi in getDevicegroups function

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getDevicegroups function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line

Products

Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more

CVE-2026-40834

Authenticated SQLi in saveDashboardLayout function

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dash_layout.php files saveDashboardLayout function due to improper neutralization of special elements in a SQL INSERT command allowing for reading the whole database and inserting entries into a non critical table. This can result in a total loss of confidentiality and some loss of integrity.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line

Products

Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more

CVE-2026-40840

Authenticated SQLi in VerifyCreateLicences function

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the VerifyCreateLicences function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line

Products

Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more

CVE-2026-40845

Authenticated SQLi in devices_configuration view

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the devices_configuration view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line

Products

Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more

CVE-2026-40849

Authenticated SQLi in user_alarmprofile view

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the user_alarmprofile view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line

Products

Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more

CVE-2026-40822

Authenticated SQLi in DevSerialReset function

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the DevSerialReset function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line

Products

Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more

CVE-2026-40827

Authenticated SQLi in _RemoveRequest function

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the _RemoveRequest function due to improper neutralization of special elements in a SQL DELETE command allowing for reading the whole database and deleting entries in a non critical table. This can result in a total loss of confidentiality and some loss of integrity.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line

Products

Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more

CVE-2026-40844

Authenticated SQLi in dashboard view

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dashboard view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line

Products

Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more

CVE-2026-42740

WordPress Tainacan plugin <= 1.0.3 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tainacan Tainacan tainacan allows Blind SQL Injection.This issue affects Tainacan: from n/a through <= 1.0.3.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Tainacan Wordpress

Products

Tainacan Wordpress

CVE-2026-40810

Unauthenticated SQLi in userinfo Endpoint

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the userinfo endpoint due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line

Products

Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more