271753 matches found
CVE-2026-95601: Improper Neutralization of Special Elements used in an SQL Command
Unauthenticated SQL Injection in Product Filter by WBW = 3.1.7 versions...
CVE-2026-95590: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in Tainacan = 1.2.0 versions...
CVE-2026-95522: Improper Neutralization of Special Elements used in an SQL Command
Shop manager SQL Injection in Easy Digital Downloads = 3.7.0 versions...
CVE-2026-93527: Improper Neutralization of Special Elements used in an SQL Command
Contributor SQL Injection in Live Copy Paste for Elementor = 1.5.10 versions...
CVE-2026-96514: Improper Neutralization of Special Elements used in an SQL Command
A weakness has been identified in Neethuharii CafeManagement. Impacted is an unknown function of the file CafePortalLogin.php of the component Login Handler. This manipulation of the argument uname causes sql injection. It is possible to initiate the attack remotely. The exploit has been made...
CVE-2026-18180: Improper Neutralization of Special Elements used in an SQL Command
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to SQL injection...
CVE-2026-96600: Improper Neutralization of Special Elements used in an SQL Command
Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled identifiers and administrator-supplied values directly into SQL statements. Authenticated Contao backend users with Isotope module permissions can exploit...
CVE-2026-91024: Improper Neutralization of Special Elements used in an SQL Command
The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query, allowing authenticated users with Author-level access and above to perform SQL injection attacks by importing a feed they control...
CVE-2022-4997: Improper Neutralization of Special Elements used in an SQL Command
The jet-form-builder-stripe-gateway WordPress plugin before 1.1.0 does not sanitise and escape a payment token before using it in a SQL statement, allowing unauthenticated users to extract arbitrary data from the database, including password hashes...
CVE-2026-96272: Improper Neutralization of Special Elements used in an SQL Command
ClipBucket v5 before 5.5.3-182 contains a blind SQL injection vulnerability in the photo search endpoint where the query parameter is passed unsanitized into SQL WHERE and ORDER BY clauses. Unauthenticated attackers can exploit time-based blind SQL injection techniques to extract user credentials...
CVE-2026-95925: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /reviewer0/admins/assessments/databank/btnfunctions.php?action=update. The manipulation of the argument difficultyid results in sql injection. The attack can ...
CVE-2026-95924: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer0/admins/assessments/databank/btnfunctions.php?action=add. The manipulation of the argument difficultyid leads to sql injection. Remote exploitation of the...
CVE-2026-96602: Improper Neutralization of Special Elements used in an SQL Command
A flaw has been found in Abdurrab5 online-makeup-store. This impacts an unknown function of the file customerSignin.php of the component Customer Login Handler. This manipulation of the argument username/password causes sql injection. The attack is possible to be carried out remotely. The exploit...
CVE-2026-96601: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was detected in Abdurrab5 online-makeup-store. This affects an unknown function of the file index.php of the component Admin Login Handler. The manipulation of the argument id/password results in sql injection. The attack can be executed remotely. The exploit is now public and may...
EUVD-2025-210998
SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP requests...
CVE-2026-90902: Improper Neutralization of Special Elements used in an SQL Command
Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0 - The coupon bulk update task administrator/index.php?option=comeasystore&task=coupon.couponBulkUpdate took input IDs and directly concatenated them into raw SQL I...
PT-2026-97193
Name of the Vulnerable Software and Affected Versions Booking Manager WordPress plugin versions prior to 2.1.21 Description Authenticated users with Author-level access and above can perform SQL injection attacks. This occurs because the plugin fails to sanitize and escape values retrieved from a...
PT-2026-97489
Unauthenticated SQL Injection in Product Filter by WBW = 3.1.7 versions...
CVE-2026-90901: Improper Neutralization of Special Elements used in an SQL Command
Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0 - The media deletion endpoint administrator/index.php?option=comeasystore&task=media.deleteImage parsed the ids parameter as a comma-separated string and implode...