WordPress Secure Copy Content Protection and Content Locking <2.8.2 - SQL Injection

WordPress Secure Copy Content Protection and Content Locking plugin before 2.8.2 contains a SQL injection vulnerability. The plugin does not escape the sccpid parameter of the ayssccpresultsexportfile AJAX action, available to both unauthenticated and authenticated users, before using it in a SQL...

PrestaShop SmartBlog <4.0.6 - SQL Injection

PrestaShop SmartBlog by SmartDataSoft 4.0.6 is vulnerable to a SQL injection vulnerability in the blog archive functionality. id: CVE-2021-37538 info: name: PrestaShop SmartBlog 4.0.6 - SQL Injection author: whoever severity: critical description: PrestaShop SmartBlog by SmartDataSoft 4.0.6 is...

WordPress Paid Memberships Pro <2.6.7 - Blind SQL Injection

WordPress Paid Memberships Pro plugin before 2.6.7 is susceptible to blind SQL injection. The plugin does not escape the discountcode in one of its REST routes before using it in a SQL statement. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized...

phpMyAdmin < 5.0.3 - SQL Injection

phpMyAdmin before 4.9.6 and 5.x before 5.0.3 contains a SQL injection caused by improper processing of SQL statements in the search feature, letting attackers inject malicious SQL, exploit requires crafted search input. id: CVE-2020-26935 info: name: phpMyAdmin 5.0.3 - SQL Injection author: 0xAko...

FreePBX - Remote Code Execution

FreePBX 15, 16, and 17 contain a remote code execution caused by insufficiently sanitized user-supplied data in endpoints, letting unauthenticated attackers manipulate the database and execute code remotely, exploit requires no authentication. id: CVE-2025-57819 info: name: FreePBX - Remote Code...

NetMRI Unauthenticated SQL Injection via skipjackUsername

An issue was discovered in Infoblox NETMRI before 7.6.1. Unauthenticated SQL Injection can occur. id: CVE-2025-32814 info: name: NetMRI Unauthenticated SQL Injection via skipjackUsername author: iamnoooob,pdresearch severity: critical description: | An issue was discovered in Infoblox NETMRI befo...

WordPress Loginizer < 1.6.4 – Unauthenticated SQL Injection via `log` Parameter

The Loginizer plugin before 1.6.4 for WordPress allows SQL injection with resultant XSS, related to loginizerloginfailed and lzvalidip. id: CVE-2020-27615 info: name: WordPress Loginizer 1.6.4 – Unauthenticated SQL Injection via log Parameter author: intelligent-ears severity: critical descriptio...

PHPGurukul Dairy Farm Shop Management System 1.0 - SQL Injection

PHPGurukul Dairy Farm Shop Management System 1.0 is vulnerable to SQL injection, as demonstrated by the username parameter in index.php, the category and CategoryCode parameters in add-category.php, the CompanyName parameter in add-company.php, and the ProductName and ProductPrice parameters in...

Grandstream UCM6200 - SQL Injection

Grandstream UCM6200 series contains an unauthenticated remote SQL injection caused by crafted HTTP requests, letting attackers execute shell commands as root on versions before 1.0.19.20 or inject HTML in emails before 1.0.20.17. id: CVE-2020-5722 info: name: Grandstream UCM6200 - SQL Injection...

Jeecg-boot 3.5.0 qurestSql - SQL Injection

A vulnerability classified as critical has been found in jeecg-boot 3.5.0. This affects an unknown part of the file jmreport/qurestSql. The manipulation of the argument apiSelectId leads to sql injection. It is possible to initiate the attack remotely. id: CVE-2023-1454 info: name: Jeecg-boot 3.5...

LearnPress <= 4.2.5.7 - SQL Injection

The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 4.2.5.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVE-2026-56292-AcyMailing-SQLi

CVE-2026-56292 — Injection SQL non authentifiée dans AcyMailing pour Joomla Auteur : nullwhisper Réservé à la recherche en sécurité autorisée et à la validation de vulnérabilités uniquement. AcyMailing pour Joomla expose la tâche publique côté front-end frontentityselect::loadEntityFront. Dans le...

CLEANSTART-2026-MW74031 Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network

Security vulnerability affects the apache-hive package. Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network...

CLEANSTART-2026-DW89349 pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE

Security vulnerability affects the apache-hive package. pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE...

CVE-2025-9776

CVE-2025-9776: حقن SQL بعد المصادقة في إضافة CatFolders لـ WordPress الكلمات المفتاحية: CVE-2025-9776, ثغرة CatFolders في WordPress, حقن SQL في WordPress, حقن SQL بعد المصادقة, أمان WordPress, ثغرة استيراد CSV, استغلال إضافات WordPress, CWE-89, هجوم قاعدة بيانات WordPress, ثغرة مكتبة الوسائط,...

PT-2026-108147

Name of the Vulnerable Software and Affected Versions MariaDB Connector/Node.js versions 3.2.0 through 3.2.4 MariaDB Connector/Node.js versions 3.3.x prior to 3.3.4 MariaDB Connector/Node.js versions 3.4.x prior to 3.4.7 MariaDB Connector/Node.js versions 3.5.x prior to 3.5.4 Description When the...

PT-2026-107825

In Brocade SANnav before 3.0.0a, an SQL Injection vulnerability in various external API inventories have a vulnerability that allows an authenticated attacker to inject malicious data into some of the REST API -query parameters...

PT-2026-108030

mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the runQueryButton postback and exportSqlQuery Server PageMethod execute caller-supplied SQL against the backing Sybase SQL Anywhere database using DBA/sysadmin...

Apache OzHera 2.2.6 Authenticated SQL Injection

Summary Apache OzHeraIncubating is an Application Performance Monitoring APM platform designed for the cloud-native era. It revolves around applications and integrates capabilities such as metric monitoring, distributed tracing, logging, and alerting. The platform's mission is to enhance the onli...

Aruba ClearPass Policy Manager 6.11.x < 6.11.16 / 6.14.x < 6.14.1 Multiple Vulnerabilities (HPESBNW05158)

The version of Aruba ClearPass Policy Manager installed on the remote host is 6.11.x prior to 6.11.16, or 6.14.x prior to 6.14.1. It is, therefore, affected by multiple vulnerabilities as referenced in the HPESBNW05158 advisory. - Deserialization of untrusted data vulnerabilities exist in the web...