https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 12:03:33 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-71248 <p>Inventory-Management-System-PHP&#39;s login.php constructs its authentication query via direct string concatenation of raw POST parameters: = &#34;select * from user where email = &#39;&#39; and password = &#39;&#39;&#34;, with no escaping or parameterization, allowing authentication bypass via a payload such as email=&#39; OR 1=1 LIMIT 1-- -.</p> <p>Inventory-Management-System-PHP&#39;s login.php constructs its authentication query via direct string concatenation of raw POST parameters: = &#34;select * from user where email = &#39;&#39; and password = &#39;&#39;&#34;, with no escaping or parameterization, allowing authentication bypass via a payload such as email=&#39; OR 1=1 LIMIT 1-- -.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-71248 https://vulnerability.circl.lu/vuln/ghsa-w54w-xf28-wf79 <p>Inventory-Management-System-PHP&#39;s login.php constructs its authentication query via direct string concatenation of raw POST parameters: $sql = &#34;select * from user where email = &#39;$email&#39; and password = &#39;$password&#39;&#34;, with no escaping or parameterization, allowing authentication bypass via a payload such as email=&#39; OR 1=1 LIMIT 1-- -. Separately, delete.php executes mysqli_query($db, &#34;DELETE FROM product WHERE product_id=&#34; . $_GET[&#39;id&#39;]) with no authentication check and no validation of the id parameter, allowing an unauthenticated attacker to delete arbitrary product rows or perform blind SQL injection via payloads such as id=0 OR SLEEP(5).</p> <p>Inventory-Management-System-PHP&#39;s login.php constructs its authentication query via direct string concatenation of raw POST parameters: $sql = &#34;select * from user where email = &#39;$email&#39; and password = &#39;$password&#39;&#34;, with no escaping or parameterization, allowing authentication bypass via a payload such as email=&#39; OR 1=1 LIMIT 1-- -. Separately, delete.php executes mysqli_query($db, &#34;DELETE FROM product WHERE product_id=&#34; . $_GET[&#39;id&#39;]) with no authentication check and no validation of the id parameter, allowing an unauthenticated attacker to delete arbitrary product rows or perform blind SQL injection via payloads such as id=0 OR SLEEP(5).</p> https://vulnerability.circl.lu/vuln/ghsa-w54w-xf28-wf79