287185 matches found
CVE-2019-9053
CVE-2019-9053 エクスプロイト - CMS Made Simple 未認証SQLインジェクション SQLi CVE-2019-9053 用のエクスプロイトスクリプトです。これは、CMS Made Simple バージョン 2.2.9 以下 における深刻な 未認証SQLインジェクション SQLi 脆弱性です。このツールは、時間ベースのSQLインジェクション を利用して、脆弱な CMS Made Simple サイトから 管理者認証情報 （ユーザー名、メールアドレス、パスワードハッシュ、ソルト）を抽出します。また、ワードリストを使用した任意の パスワードクラッキング...
CVE-2026-77161
The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Injection via Parameter Name in all versions up to, and including, 5.1.24 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...
CVE-2026-85198
The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin for WordPress is vulnerable to generic SQL Injection via URL Path in all versions up to, and including, 4.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
CVE-2026-16482
The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'compare' parameter in all versions up to, and including, 4.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
CVE-2026-77161 Smart Marketing SMS and Newsletters Forms <= 5.1.24 - Authenticated (Subscriber+) SQL Injection via Parameter Name
The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Injection via Parameter Name in all versions up to, and including, 5.1.24 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...
CVE-2026-77161 Smart Marketing SMS and Newsletters Forms <= 5.1.24 - Authenticated (Subscriber+) SQL Injection via Parameter Name
The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Injection via Parameter Name in all versions up to, and including, 5.1.24 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...
CVE-2026-77161
The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to SQL Injection via Parameter Name in all versions up to and including 5.1.24 . The root cause is insufficient escaping on a user-supplied parameter and lack of sufficient preparation of the existing SQL query, allo...
EUVD-2026-76835
The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Injection via Parameter Name in all versions up to, and including, 5.1.24 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...
CVE-2026-85198
The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO WordPress plugin is vulnerable to SQL injection via URL path in versions up to and including 4.2.1 , caused by insufficient escaping and lack of prepared statements on a user-supplied parameter. Despite the title referencing...
CVE-2026-85198 MPG <= 4.2.1 - Unauthenticated SQL Injection via URL Path
The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin for WordPress is vulnerable to generic SQL Injection via URL Path in all versions up to, and including, 4.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
EUVD-2026-76831
The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin for WordPress is vulnerable to generic SQL Injection via URL Path in all versions up to, and including, 4.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
CVE-2026-85198 MPG <= 4.2.1 - Unauthenticated SQL Injection via URL Path
The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin for WordPress is vulnerable to generic SQL Injection via URL Path in all versions up to, and including, 4.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
CVE-2026-16482
The rtMedia for WordPress, BuddyPress and bbPress plugin (up to and including 4.7.11 ) is vulnerable to an unauthenticated time-based blind SQL Injection via the compare parameter. The root cause lies in RTMediaQuery::query(), which merges $_REQUEST into the internal query while only validating t...
EUVD-2026-76828
The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'compare' parameter in all versions up to, and including, 4.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
CVE-2026-16482 rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 - Unauthenticated SQL Injection via 'compare' Parameter
The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'compare' parameter in all versions up to, and including, 4.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
CVE-2026-16482 rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 - Unauthenticated SQL Injection via 'compare' Parameter
The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'compare' parameter in all versions up to, and including, 4.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
CVE-2026-84047
The Album Cover Finder WordPress plugin through 0.7.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...
CVE-2026-80491
The SAMO Forms WordPress plugin through 1.0.0 does not properly sanitise and escape user input before using it in SQL queries in several unauthenticated actions, allowing unauthenticated attackers to perform SQL injection attacks...
CVE-2026-84047 Album Cover Finder <= 0.7.0 - Unauthenticated SQLi via and_action
The Album Cover Finder WordPress plugin through 0.7.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...