PT-2026-97401

Name of the Vulnerable Software and Affected Versions Neethuharii CafeManagement affected versions not specified Description A SQL injection flaw exists in the Login Handler component within the CafePortalLogin.php file. A remote attacker can exploit this by manipulating the uname argument,...

CVE-2026-95925: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /reviewer0/admins/assessments/databank/btnfunctions.php?action=update. The manipulation of the argument difficultyid results in sql injection. The attack can ...

CVE-2026-95601: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Product Filter by WBW = 3.1.7 versions...

CVE-2026-93527: Improper Neutralization of Special Elements used in an SQL Command

Contributor SQL Injection in Live Copy Paste for Elementor = 1.5.10 versions...

PT-2026-97121

Name of the Vulnerable Software and Affected Versions SourceCodester Online Reviewer Management System version 1.0 Description Remote SQL injection is possible through the manipulation of the difficulty id variable within an unknown function of the '/reviewer 0/admins/assessments/databank/btn...

CVE-2026-95590: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Tainacan = 1.2.0 versions...

PT-2026-97387

Name of the Vulnerable Software and Affected Versions Moodle Socialwall plugin versions 3.0 through 3.3 Description A SQL injection flaw allows an attacker to execute arbitrary code by sending specially crafted HTTP requests. SQL injection is a technique where malicious SQL statements are inserte...

CVE-2025-63564

SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP requests...

PT-2026-97154

Name of the Vulnerable Software and Affected Versions jet-form-builder-stripe-gateway WordPress plugin versions prior to 1.1.0 Description An issue exists where a payment token is not properly sanitized or escaped before being used in a SQL statement. This allows unauthenticated users to perform...

CVE-2026-96826: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Shazzad Hossain Khan W4 Post List allows Blind SQL Injection. This issue affects W4 Post List: from n/a through 3.0.6...

PT-2026-97346

Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled identifiers and administrator-supplied values directly into SQL statements. Authenticated Contao backend users with Isotope module permissions can exploit...

CVE-2026-95522: Improper Neutralization of Special Elements used in an SQL Command

Shop manager SQL Injection in Easy Digital Downloads = 3.7.0 versions...

CVE-2026-18180: Improper Neutralization of Special Elements used in an SQL Command

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to SQL injection...

CVE-2026-96272: Improper Neutralization of Special Elements used in an SQL Command

ClipBucket v5 before 5.5.3-182 contains a blind SQL injection vulnerability in the photo search endpoint where the query parameter is passed unsanitized into SQL WHERE and ORDER BY clauses. Unauthenticated attackers can exploit time-based blind SQL injection techniques to extract user credentials...

PT-2026-97452

Contributor SQL Injection in Mollie Forms = 2.11.0 versions...

CVE-2026-91024: Improper Neutralization of Special Elements used in an SQL Command

The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query, allowing authenticated users with Author-level access and above to perform SQL injection attacks by importing a feed they control...

CVE-2022-4997: Improper Neutralization of Special Elements used in an SQL Command

The jet-form-builder-stripe-gateway WordPress plugin before 1.1.0 does not sanitise and escape a payment token before using it in a SQL statement, allowing unauthenticated users to extract arbitrary data from the database, including password hashes...

CVE-2026-96601: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in Abdurrab5 online-makeup-store. This affects an unknown function of the file index.php of the component Admin Login Handler. The manipulation of the argument id/password results in sql injection. The attack can be executed remotely. The exploit is now public and may...

CVE-2026-96602: Improper Neutralization of Special Elements used in an SQL Command

A flaw has been found in Abdurrab5 online-makeup-store. This impacts an unknown function of the file customerSignin.php of the component Customer Login Handler. This manipulation of the argument username/password causes sql injection. The attack is possible to be carried out remotely. The exploit...

CVE-2026-96514: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in Neethuharii CafeManagement. Impacted is an unknown function of the file CafePortalLogin.php of the component Login Handler. This manipulation of the argument uname causes sql injection. It is possible to initiate the attack remotely. The exploit has been made...