CVE-2026-88395

GouGuOA v6.0.5 and before is vulnerable to SQL Injection in /home/message/rubbish via the keywords parameter...

CVE-2026-102428

Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK 8.3.16 - The order column for records was user provided and not properly validated, leading to a SQL injection vector...

WordPress ARMember Premium plugin <= 7.8 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Rafie Muhammad in WordPress Plugin ARMember Premium versions = 7.8...

WordPress UDesign Core plugin <= 4.15.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Rafie Muhammad in WordPress Plugin UDesign Core versions = 4.15.0...

WordPress ListingPro plugin <= 2.9.12 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Rafie Muhammad in WordPress Plugin ListingPro versions = 2.9.12...

WordPress Porto Theme - Functionality plugin <= 3.9.3 - SQL Injection vulnerability

WordPress Porto Theme - Functionality plugin = 3.9.3 - SQL Injection vulnerability discovered by Rafie Muhammad in WordPress Plugin Porto Theme - Functionality versions = 3.9.3...

CVE-2026-102428

The OrdaSoft Joomla CCK extension (versions

CVE-2026-102428 Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16

Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK 8.3.16 - The order column for records was user provided and not properly validated, leading to a SQL injection vector...

EUVD-2026-92449

Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK 8.3.16 - The order column for records was user provided and not properly validated, leading to a SQL injection vector...

CVE-2026-102428 Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16

Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK 8.3.16 - The order column for records was user provided and not properly validated, leading to a SQL injection vector...

WordPress Newsletter Subscription Form – User Subscriptions Form, Capture Email plugin <= 1.5.9 - SQL Injection vulnerability

SQL Injection vulnerability discovered by dzeusking in WordPress Plugin Newsletter Subscription Form – User Subscriptions Form, Capture Email versions = 1.5.9...

WordPress WP2LEADS plugin <= 3.5.7 - SQL Injection vulnerability

SQL Injection vulnerability discovered by johska in WordPress Plugin WP2LEADS versions = 3.5.7...

CKAN DataStore SQL Injection (CVE-2026-42031)

Exploits CVE-2026-42031 unauthenticated SQL injection in CKAN datastoresearchsql API via PostgreSQL tsrewrite primitives. !/usr/bin/env python3 -- coding: utf-8 -- """CKAN datastoresearchsql unauth SQLi CVE-2026-42031.""" import json import urllib.parse from kittysploit import from...

wp2shell

CVE-2026-63030 + CVE-2026-60137 – „wp2shell“: Unauthenticatede RCE im WordPress-Core Batch-Routen-Verwirrung der REST-API CVE-2026-63030 verknüpft mit einer WPQuery-authornotin-SQL-Injection CVE-2026-60137 → Pre-Auth Remote Code Execution gegen eine Standard-WordPress-Installation. Entdeckt von...

WordPress Booknetic plugin <= 4.8.5 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Bonds in WordPress Plugin Booknetic versions = 4.8.5...

WordPress Woffice theme <= 5.4.35 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Bonds in WordPress Theme Woffice versions = 5.4.35...

BIT-MOODLE-2026-102578 Moodle: sql injection in question bank web service

A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL Structured Query Language injection vulnerability. This issue could allow an attacker to view, alter, or delete...

Astra Linux – Vulnerability in OpenLDAP

In OpenLDAP 2.x versions before 2.5.12 and 2.6.x versions before 2.6.2, there is a SQL injection vulnerability in the experimental slapd backend, caused by a SQL statement within an LDAP query. This vulnerability can occur during an LDAP search operation, when the search filter is processed, due ...

Astra Linux – Vulnerability in PostgresSQL 11

When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries during the initial establishment of a connection, despite the use of SSL certificate verification and encryption...

Astra Linux – Vulnerability in Apache Log4j1.2

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter, where the values to be inserted are converted using PatternLayout. The message converter %m is likely to always be included. This allows attackers to manipulate SQL statements by entering crafted...