PT-2026-90493

Name of the Vulnerable Software and Affected Versions Woltlab WCF versions prior to 6.2.5 Description A remote attacker can perform a SQL Injection, which is a technique that allows an attacker to interfere with the queries that an application makes to its database. This issue occurs within the...

PT-2026-89911

Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.4.18 Description An unauthenticated blind SQL injection exists in the SQL escaping layer. This issue allows attackers to inject arbitrary SQL by providing a crafted annee parameter value consisting of a word character...

SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37984)

Sales and Inventory System is a business resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability. This vulnerability arises from the failure of the /pages/prosearchfrm.php file to properly validate the...

SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37989)

Sales and Inventory System is a business resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability, which stems from the improper validation of the companyname parameter in the /pages/suptransac.php file...

SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37986)

Sales and Inventory System is an enterprise resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability, which stems from the failure to properly validate the ID parameter in the /pages/settings Edit.php...

IDORacle: Template-Guided SQL-Sink Mediation for Object-Level Authorization in Java Applications

Insecure Direct Object Reference IDOR, often modeled as Broken Object-Level Authorization BOLA, remains prevalent in Java database applications because identity and authorization checks at the controller or service layer are disconnected from SQL execution based on resource identifiers. Existing...

PT-2026-90024

Editor SQL Injection in Sky Addons for Elementor = 3.8.4 versions...

CVE-2026-52630

SQL Injection vulnerability in Woltlab WCF v.6.2.4 and before allows a remote attacker to updateUserOptions in UserEditor.class.php and the update action in UserAction.class.php...

SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37987)

Sales and Inventory System is a business resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability. This vulnerability stems from the improper filtering of the ID parameter in the /pages/emp Edit1.php...

CVE-2026-15439: Improper Neutralization of Special Elements used in an SQL Command

The GamiPress plugin for WordPress is vulnerable to authenticated Subscriber+ SQL Injection via the 'q' parameter of the wpForo integration AJAX selector action gamipresswpforogetposts in versions up to, and including, 7.9.7. The value is passed only through $wpdb-esclike and interpolated directl...

CVE-2026-15462: Improper Neutralization of Special Elements used in an SQL Command

The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scwformfields' parameter array keys of the 'scwsaveformdata' AJAX action in versions up to, and including, 1.4.2. This is due to the saveformdata function passing attacker-controlled POST array keys unsanitized to...

PT-2026-90593

Name of the Vulnerable Software and Affected Versions rtMedia for WordPress, BuddyPress and bbPress versions prior to 4.7.12 Description The plugin is subject to time-based blind SQL Injection, a technique where an attacker asks the database true/false questions and determines the answer based on...

PT-2026-89749

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, and including, 2.0.16. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query in...

PT-2026-89895

The GamiPress plugin for WordPress is vulnerable to authenticated Subscriber+ SQL Injection via the 'q' parameter of the wpForo integration AJAX selector action gamipress wpforo get posts in versions up to, and including, 7.9.7. The value is passed only through $wpdb-esc like and interpolated...

CVE-2026-18561: Improper Neutralization of Special Elements used in an SQL Command

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, and including, 2.0.16. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query in...

CVE-2026-52630

SQL Injection vulnerability in Woltlab WCF v.6.2.4 and before allows a remote attacker to updateUserOptions in UserEditor.class.php and the update action in UserAction.class.php...

SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37983)

Sales and Inventory System is a business resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability. This vulnerability arises from the failure of the /pages/custedit1.php file to properly validate the ID...

SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37985)

Sales and Inventory System is a business resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability. This vulnerability arises from the failure to properly validate the user ID parameter input in the...

CVE-2026-82583: Improper Neutralization of Special Elements used in an SQL Command

NextGen Connect Mirth Connect versions 4.7.1 and earlier allow an authenticated user to execute arbitrary SQL through a Database Connector API, which could result in disclosure of stored credentials for connected systems, arbitrary file write, and a denial-of-service condition...

SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37988)

Sales and Inventory System is a business resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability. This vulnerability stems from the improper handling of the Username parameter in the /pages/ustransac.p...