PT-2026-97476

Name of the Vulnerable Software and Affected Versions Easy Digital Downloads versions prior to 3.7.1 Description An SQL Injection issue exists in the Shop manager component. This allows an attacker to interfere with the queries that an application makes to its database, potentially allowing them ...

PT-2026-97459

Administrator SQL Injection in Email Log = 2.63 versions...

CVE-2025-63564

SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP requests...

CVE-2026-95522: Improper Neutralization of Special Elements used in an SQL Command

Shop manager SQL Injection in Easy Digital Downloads = 3.7.0 versions...

CVE-2026-94124: Improper Neutralization of Special Elements used in an SQL Command

Contributor SQL Injection in WP EasyCart = 5.9.4 versions...

CVE-2026-91024: Improper Neutralization of Special Elements used in an SQL Command

The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query, allowing authenticated users with Author-level access and above to perform SQL injection attacks by importing a feed they control...

CVE-2026-14913: Improper Neutralization of Special Elements used in an SQL Command

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.669 and below were vulnerable to an SQL Injection vulnerability in Rule Management Search Reports...

CVE-2026-90902: Improper Neutralization of Special Elements used in an SQL Command

Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0 - The coupon bulk update task administrator/index.php?option=comeasystore&task=coupon.couponBulkUpdate took input IDs and directly concatenated them into raw SQL I...

The vulnerability of the Cisco Identity Services Engine (ISE) platform, related to the lack of protective measures for the SQL query structure, allows a hacker to execute arbitrary code.

The vulnerability of the Cisco Identity Services Engine ISE platform relates to the lack of security measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the Cisco Identity Services Engine (ISE) platform, related to the lack of security measures for SQL query structures, allows a hacker to execute arbitrary code.

The vulnerability of the Cisco Identity Services Engine ISE platform relates to the lack of security measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2022-4997: Improper Neutralization of Special Elements used in an SQL Command

The jet-form-builder-stripe-gateway WordPress plugin before 1.1.0 does not sanitise and escape a payment token before using it in a SQL statement, allowing unauthenticated users to extract arbitrary data from the database, including password hashes...

PT-2026-97118

Name of the Vulnerable Software and Affected Versions AdithyaYelloju Restaurant-Management-System versions up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c Description An issue exists in the Search Form component within the file admin/display menu.php. A remote attacker can trigger a SQL injection ...

CVE-2026-95868: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Affected by this issue is the function mysqliquery of the file admin/displaymenu.php of the component Search Form. This manipulation of the argument s1 causes sql injectio...

CVE-2026-95601: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Product Filter by WBW = 3.1.7 versions...

PT-2026-97489

Unauthenticated SQL Injection in Product Filter by WBW = 3.1.7 versions...

CVE-2026-96272: Improper Neutralization of Special Elements used in an SQL Command

ClipBucket v5 before 5.5.3-182 contains a blind SQL injection vulnerability in the photo search endpoint where the query parameter is passed unsanitized into SQL WHERE and ORDER BY clauses. Unauthenticated attackers can exploit time-based blind SQL injection techniques to extract user credentials...

PT-2026-97123

Name of the Vulnerable Software and Affected Versions ClipBucket versions 5.x through 5.5.3-182 Description An issue exists in the photo search endpoint search result.php where the query parameter is passed unsanitized into SQL WHERE and ORDER BY clauses. This allows unauthenticated attackers to...

PT-2026-97154

Name of the Vulnerable Software and Affected Versions jet-form-builder-stripe-gateway WordPress plugin versions prior to 1.1.0 Description An issue exists where a payment token is not properly sanitized or escaped before being used in a SQL statement. This allows unauthenticated users to perform...

CVE-2026-18180: Improper Neutralization of Special Elements used in an SQL Command

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to SQL injection...

CVE-2026-93368: Improper Neutralization of Special Elements used in an SQL Command

The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' Username Parameter in all versions up to, and including, 2.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...