287203 matches found
CVE-2026-18561 Unlimited Elements For Elementor <= 2.0.16 - Unauthenticated SQL Injection
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, and including, 2.0.16. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query in...
EUVD-2026-75932
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, and including, 2.0.16. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query in...
CVE-2026-18561
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) for WordPress is vulnerable to unauthenticated SQL injection in versions up to and including 2.0.16 . The flaw resides in the addontype parameter: when supplied as an array, element zero is used verbatim as a SQL comparison operat...
CVE-2026-15462 Sticky Chat Widget <= 1.4.2 - Unauthenticated SQL Injection
The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scwformfields' parameter array keys of the 'scwsaveformdata' AJAX action in versions up to, and including, 1.4.2. This is due to the saveformdata function passing attacker-controlled POST array keys unsanitized to...
CVE-2026-15462 Sticky Chat Widget <= 1.4.2 - Unauthenticated SQL Injection
The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scwformfields' parameter array keys of the 'scwsaveformdata' AJAX action in versions up to, and including, 1.4.2. This is due to the saveformdata function passing attacker-controlled POST array keys unsanitized to...
EUVD-2026-75954
The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scwformfields' parameter array keys of the 'scwsaveformdata' AJAX action in versions up to, and including, 1.4.2. This is due to the saveformdata function passing attacker-controlled POST array keys unsanitized to...
CVE-2026-15462
CVE-2026-15462 affects the Sticky Chat Widget WordPress plugin in versions up to and including 1.4.2 . The vulnerability is an unauthenticated SQL injection via the scw_form_fields parameter array keys in the scw_save_form_data AJAX action. The save_form_data() function passes attacker-controlled...
SQL Server Management Studio (September 2026)
The SQL Server Management Studio installation on the remote host is missing a security update. It is, therefore, affected by an other vulnerability: - Improper neutralization of special elements in output used by a downstream component 'injection' in SQL Server allows an unauthorized attacker to...
Microsoft SQL Server (September 2026)
The Microsoft SQL Server installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network. CVE-2026-77482 - Integer overflow or wraparound ...
CVE-2026-52630: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in Woltlab WCF v.6.2.4 and before allows a remote attacker to updateUserOptions in UserEditor.class.php and the update action in UserAction.class.php...
CVE-2026-62112: Improper Neutralization of Special Elements used in an SQL Command
Editor SQL Injection in Amelia = 2.4.9 versions...
CVE-2026-62109: Improper Neutralization of Special Elements used in an SQL Command
Editor SQL Injection in Sky Addons for Elementor = 3.8.4 versions...
CVE-2026-72708: Improper Neutralization of Special Elements used in an SQL Command
SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the SQL escaping layer that allows unauthenticated attackers to inject arbitrary SQL by supplying a crafted annee parameter value matching a word character followed by an open parenthesis, which bypasses escaping...
CVE-2026-15439: Improper Neutralization of Special Elements used in an SQL Command
The GamiPress plugin for WordPress is vulnerable to authenticated Subscriber+ SQL Injection via the 'q' parameter of the wpForo integration AJAX selector action gamipresswpforogetposts in versions up to, and including, 7.9.7. The value is passed only through $wpdb-esclike and interpolated directl...
CVE-2026-18561: Improper Neutralization of Special Elements used in an SQL Command
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, and including, 2.0.16. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query in...
PT-2026-89895
The GamiPress plugin for WordPress is vulnerable to authenticated Subscriber+ SQL Injection via the 'q' parameter of the wpForo integration AJAX selector action gamipress wpforo get posts in versions up to, and including, 7.9.7. The value is passed only through $wpdb-esc like and interpolated...
PT-2026-90027
Editor SQL Injection in Amelia = 2.4.9 versions...
PT-2026-90024
Editor SQL Injection in Sky Addons for Elementor = 3.8.4 versions...
PT-2026-89911
Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.4.18 Description An unauthenticated blind SQL injection exists in the SQL escaping layer. This issue allows attackers to inject arbitrary SQL by providing a crafted annee parameter value consisting of a word character...