CVE-2026-42708: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in AF themes WP Post Author wp-post-author allows Blind SQL Injection.This issue affects WP Post Author: from n/a through 4.0.0...

CVE-2026-42721: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in SERVIT Software Solutions affiliate-toolkit affiliate-toolkit-starter allows Blind SQL Injection.This issue affects affiliate-toolkit: from n/a through 3.9.1...

CVE-2026-42713: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Gopiplus Post title marquee scroll post-title-marquee-scroll allows Blind SQL Injection.This issue affects Post title marquee scroll: from n/a through 9.9...

CVE-2026-104667: Improper Neutralization of Special Elements used in an SQL Command

The Animated Number Counters WordPress plugin before 3.1 does not sanitise or escape a value stored by an Editor-level user before concatenating it into a SQL query that runs when any unauthenticated visitor renders a page containing the counter, leading to second-order SQL injection that can rea...

CVE-2026-76452: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an authenticated, remote attacker to conduct SQL injection attacks against an affected application. This vulnerability is due to insufficient...

PT-2026-111412

Name of the Vulnerable Software and Affected Versions Payload CMS versions prior to 3.90.0 Payload CMS versions prior to 4.0.0-canary.34 Description An authenticated attacker can perform SQL Injection attacks due to improper neutralization of user input provided to the in and not in query...

PT-2026-107474

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in SERVIT Software Solutions affiliate-toolkit affiliate-toolkit-starter allows Blind SQL Injection.This issue affects affiliate-toolkit: from n/a through 3.9.1...

CVE-2026-42714: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Piggly Dev Pix por Piggly para Woocommerce pix-por-piggly allows Blind SQL Injection.This issue affects Pix por Piggly para Woocommerce: from n/a through 2.1.2...

MiracleLinux 8 : mariadb-connector-c-3.1.11-3.el8_10 (AXSA:2026-1985:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1985:01 advisory. mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysqlrealescapestring CVE-2026-44172 Tenable has...

CVE-2026-95605: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Passionate Programmer Peter WP Data Access allows Blind SQL Injection. This issue affects WP Data Access: from n/a through 5.5.82...

PT-2026-107472

An SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary SQL query on the affected product...

PT-2026-107425

Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership 7.4.0 - site/simplemembership.php dispatches task=checkLoginPass with no authentication or access control check of any kind. The handler reads a login request parameter through Joomla’s generic,...

CVE-2026-102782: Improper Neutralization of Special Elements used in an SQL Command

Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership 7.4.0 - site/simplemembership.php dispatches task=checkLoginPass with no authentication or access control check of any kind. The handler reads a login request parameter through Joomla’s generic,...

CVE-2026-103668: Improper Neutralization of Special Elements used in an SQL Command

An SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary SQL query on the affected product...

MiracleLinux 9 : mariadb-connector-c-3.2.6-2.el9_8 (AXSA:2026-1988:02)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1988:02 advisory. mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysqlrealescapestring CVE-2026-44172 Tenable has...

PT-2026-107404

The Animated Number Counters WordPress plugin before 3.1 does not sanitise or escape a value stored by an Editor-level user before concatenating it into a SQL query that runs when any unauthenticated visitor renders a page containing the counter, leading to second-order SQL injection that can rea...

PT-2026-107477

Name of the Vulnerable Software and Affected Versions Pix por Piggly para Woocommerce versions prior to 2.1.3 Description An issue involving improper neutralization of special elements used in an SQL command allows for Blind SQL Injection. Blind SQL Injection is a technique where an attacker asks...

PT-2026-107487

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in 10Web Slider by 10Web slider-wd allows Blind SQL Injection.This issue affects Slider by 10Web: from n/a through 1.2.63...

CVE-2026-42710: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in 10Web Slider by 10Web slider-wd allows Blind SQL Injection.This issue affects Slider by 10Web: from n/a through 1.2.63...

Oracle Linux 8 : dovecot (ELSA-2026-76763)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-76763 advisory. - fix CVE-2026-33605: ManageSieve login deadlock caused by lone CR protocol violation RHEL-251995 - fix CVE-2026-42007: heap use-after-free in...