CVE-2026-77161: Improper Neutralization of Special Elements used in an SQL Command

The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Injection via Parameter Name in all versions up to, and including, 5.1.24 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2026-85198: Improper Neutralization of Special Elements used in an SQL Command

The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin for WordPress is vulnerable to generic SQL Injection via URL Path in all versions up to, and including, 4.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

Exploit for CVE-2026-89012

CVE-2026-89012 — Dolibarr SQL Filter Denylist Bypass Exploit...

web-vulnerabilities-demo

Web Security — Five Common Vulnerabilities A hands-on project...

GHSA-RQFV-2MW9-78G2 MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)

Summary In SSE/HTTP transport mode, mysqlmcpserver constructs SseServerTransport without passing securitysettings. As a result, the MCP Python SDK's DNS-rebinding protection Origin/Host header validation is disabled; the Starlette application has no CORS or TrustedHost middleware; and the service...

MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)

Summary In SSE/HTTP transport mode, mysqlmcpserver constructs SseServerTransport without passing securitysettings. As a result, the MCP Python SDK's DNS-rebinding protection Origin/Host header validation is disabled; the Starlette application has no CORS or TrustedHost middleware; and the service...

CVE-2026-52630

SQL Injection vulnerability in Woltlab WCF v.6.2.4 and before allows a remote attacker to updateUserOptions in UserEditor.class.php and the update action in UserAction.class.php...

WordPress MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin <= 4.2.1 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Nhien Pham nhienit nhienit, thevietronin in WordPress Plugin MPG versions = 4.2.1...

CVE-2026-62112

Editor SQL Injection in Amelia = 2.4.9 versions...

CVE-2026-62109

Editor SQL Injection in Sky Addons for Elementor = 3.8.4 versions...

Exploit for CVE-2026-14962

CVE-2026-14962 Wordpress Plugin ELEX WooCommerce Request a Quo...

CVE-2026-62112 WordPress Amelia plugin <= 2.4.9 - SQL Injection vulnerability

Editor SQL Injection in Amelia = 2.4.9 versions...

CVE-2026-62112

CVE-2026-62112 affects the Amelia WordPress plugin in versions ≤ 2.4.9 , containing an Editor-level SQL Injection vulnerability discovered by Ananda Dhakal (Patchstack). The vulnerability requires high privileges (editor role) to exploit but carries a CVSS 3.1 score of 7.6 (HIGH) with high confid...

CVE-2026-62112 WordPress Amelia plugin <= 2.4.9 - SQL Injection vulnerability

Editor SQL Injection in Amelia = 2.4.9 versions...

EUVD-2026-76208

Editor SQL Injection in Amelia = 2.4.9 versions...

EUVD-2026-76211

Editor SQL Injection in Sky Addons for Elementor = 3.8.4 versions...

CVE-2026-62109 WordPress Sky Addons for Elementor plugin <= 3.8.4 - SQL Injection vulnerability

Editor SQL Injection in Sky Addons for Elementor = 3.8.4 versions...

CVE-2026-62109 WordPress Sky Addons for Elementor plugin <= 3.8.4 - SQL Injection vulnerability

Editor SQL Injection in Sky Addons for Elementor = 3.8.4 versions...

CVE-2026-62109

Editor SQL Injection vulnerability in the Sky Addons for Elementor WordPress plugin, affecting versions 3.8.4 and below . Discovered by Ananda Dhakal via Patchstack, the flaw resides in the editor functionality and allows a high-privilege authenticated user to inject SQL, resulting in high confid...

CVE-2026-72708

SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the SQL escaping layer that allows unauthenticated attackers to inject arbitrary SQL by supplying a crafted annee parameter value matching a word character followed by an open parenthesis, which bypasses escaping...