Drupal Core - Anonymous SQL Injection via PostgreSQL Entity Query

Drupal core from 8.9.0 before 10.4.10, 10.5.0 before 10.5.10, 10.6.0 before 10.6.9, 11.0.0 before 11.1.10, 11.2.0 before 11.2.12, and 11.3.0 before 11.3.10 contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL...

CVE-2026-16334

A vulnerability was identified in itsourcecode Hospital Management System 1.0. This vulnerability affects unknown code of the file /prescriptionorder.php. Such manipulation of the argument editid leads to sql injection. The attack can be launched remotely. The exploit is publicly available and...

CVE-2026-16334 itsourcecode Hospital Management System prescriptionorder.php sql injection

A vulnerability was identified in itsourcecode Hospital Management System 1.0. This vulnerability affects unknown code of the file /prescriptionorder.php. Such manipulation of the argument editid leads to sql injection. The attack can be launched remotely. The exploit is publicly available and...

CVE-2026-16334

A vulnerability was identified in itsourcecode Hospital Management System 1.0. This vulnerability affects unknown code of the file /prescriptionorder.php. Such manipulation of the argument editid leads to sql injection. The attack can be launched remotely. The exploit is publicly available and...

CVE-2026-16334

The CVE-2026-16334 entry concerns itsourcecode Hospital Management System 1.0. A SQL injection vulnerability is present in an unknown code path of /prescriptionorder.php, triggered by manipulating the editid parameter. The issue is exploitable remotely, and publicly available exploit material exi...

CVE-2026-52472

SQL injection vulnerability in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the PortInfoMapper.xml file...

CVE-2026-52472

SQL injection vulnerability in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the PortInfoMapper.xml file...

CVE-2026-52472

CVE-2026-52472 is an SQL injection vulnerability affecting Wgcloud 3.6.4, exploitable via the PortInfoMapper.xml file. The NVD entry describes that a remote attacker can escalate privileges by sending crafted input to this component. The CVSS v3.1 vector indicates a network-accessible, low-comple...

CVE-2026-52470

Technical details about CVE-2026-52470 are not publicly available in the provided documents. No affected products, versions, impact, or remediation specifics are disclosed here. Monitor for updates from official sources.

CVE-2026-52469

CVE-2026-52469 affects Crocus v1.3.44. A SQL injection vulnerability in DeviceInfoMapper.xml allows a remote attacker to escalate privileges. The issue is described with a high-severity CVSS v3.1 base score of 9.8 (CRITICAL), with network attack vector and no user interaction required. Authors re...

WordPress Core Interpretation Conflict Vulnerability

WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137...

WordPress Core SQL Injection Vulnerability

WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations...

CVE-2026-52469

SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the DeviceInfoMapper.xml file...

UBUNTU-CVE-2026-39879

Due to a missing sanitization call in afsqlddrunquery...

CVE-2026-52476

SQL Injection vulnerability in aiflowy = 2.1.2 allows a remote attacker to obtain sensitive information via the getPageData method in the DatacenterQuery.java file...

📄 WordPress Contact Forms by CRM Perks 1.0.7 Unauthenticated Blind SQL Injection

WordPress Contact Forms by CRM Perks plugin version 1.0.7 contains an unauthenticated time-based blind SQL injection vulnerability. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit demonstrates the...

📄 WordPress WP Extended 3.0.12 Unauthenticated Blind SQL Injection

WordPress WP Extended plugin version 3.0.12 contains an unauthenticated time-based blind SQL injection vulnerability through X-Forwarded-For. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit...

📄 WordPress Community Events 1.5.1 Unauthenticated Blind SQL Injection

WordPress Community Events plugin version 1.5.1 contains an unauthenticated time-based blind SQL injection vulnerability. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit demonstrates the vulnerabl...

📄 WordPress UsersWP 1.2.10 Unauthenticated Blind SQL Injection

WordPress UsersWP plugin version 1.2.10 contains an unauthenticated time-based blind SQL injection vulnerability through ORDER BY. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit demonstrates the...

CVE-2026-47255

The CVE-2026-47255 entry concerns AgenticMail API/core vulnerabilities in versions prior to 0.9.32 and 0.9.10, respectively. The connected documents specify multiple hardening and validation weaknesses across storage and outbound relay handling, including: (1) validation and binding of inactive-a...