CVE-2026-19071

Technical details about CVE-2026-19071 are not publicly available in the provided documents. Monitor for updates from linked sources, as no affected versions, root cause, or remediation details are included here.

CVE-2026-19071 itsourcecode Hospital Management System viewappointment.php sql injection

A flaw has been found in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /viewappointment.php. This manipulation of the argument delid causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used...

CVE-2026-19069 itsourcecode Hospital Management System treatmentrecord.php sql injection

A security vulnerability has been detected in itsourcecode Hospital Management System 1.0. This affects an unknown function of the file /treatmentrecord.php. The manipulation of the argument editid leads to sql injection. The attack is possible to be carried out remotely. The exploit has been...

CVE-2026-19067 itsourcecode Hospital Management System treatment.php sql injection

A security flaw has been discovered in itsourcecode Hospital Management System 1.0. The affected element is an unknown function of the file /treatment.php. Performing a manipulation of the argument editid results in sql injection. Remote exploitation of the attack is possible. The exploit has bee...

CVE-2026-15256 Ninja Forms < 3.14.10 - Unauthenticated Arbitrary Shortcode Execution via Query-String Populated Field Default

The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to pre-populate a form field's default value, from being processed as a shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes registered on the site when a form so...

CVE-2026-15256 Ninja Forms < 3.14.10 - Unauthenticated Arbitrary Shortcode Execution via Query-String Populated Field Default

The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to pre-populate a form field's default value, from being processed as a shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes registered on the site when a form so...

CVE-2026-15256

The CVE affects the Ninja Forms WordPress plugin (pre-3.14.10). The issue arises because user-supplied query-string input used to pre-populate a field’s default value is not filtered and can be processed as a shortcode, enabling unauthenticated attackers to execute arbitrary shortcodes registered...

CVE-2026-70635

TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability that allows authenticated attackers to cause query-result integrity failures or backend crashes by supplying a crafted Simple8b selector-11 value, which is stored in the signed int16 Arrow...

CVE-2026-65508

Unauthenticated SQL Injection in Simply Schedule Appointments = 1.6.12.10 versions...

ALPINE-CVE-2026-34191

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Portable Runtime Utility via aprdbdoracle provider. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3...

CVE-2026-5423 Subscription Authentication Bypass via Unverified connectionParams.jwt

@neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription connectionParams. As a result, any unauthenticated remote client that can open a GraphQL-over-WebSocket connection can forge arbitrary JW...

CVE-2026-66447

CVE-2026-66447 : Unauthenticated SQL Injection in WordPress File Upload plugin

EUVD-2026-53964

Unauthenticated SQL Injection in Simply Schedule Appointments = 1.6.12.10 versions...

WebExploitation-Notes

BookSheetCTF - Web Security CheatSheet & Concept Guide Selama...

WordPress JoomSport – for Sports: Team & League, Football, Hockey & more plugin <= 5.7.9 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Nicolas Decayeux in WordPress Plugin JoomSport versions = 5.7.9...

CVE-2026-19021

SourceCodester Computer Repair Shop Management System 1.0 is affected by a remote SQL injection in the file /classes/Master.php?f=delete_product, caused by manipulated ID parameter. The vulnerability can be exploited without authentication and has publicly disclosed exploit details. No patch/reme...

CVE-2026-19020 itsourcecode Hospital Management System servicetype.php sql injection

A weakness has been identified in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /servicetype.php. This manipulation of the argument editid causes sql injection. It is possible to initiate the attack remotely. The exploit has be...

CVE-2026-12713 WPCargo Track & Trace < 8.0.4 - Unauthenticated SQL Injection via wpcargo_tracking_number

The WPCargo Track & Trace WordPress plugin before 8.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks. This affects a code path distinct from the one addressed by CVE-2024-44004...

CVE-2026-16065 Welcart e-Commerce < 2.11.32 - Editor+ SQL Injection via CSV Import

The Welcart e-Commerce WordPress plugin before 2.11.32 does not properly sanitise a value taken from an imported CSV file before using it in a SQL statement, allowing users with the Editor role and above including its custom shop-management roles to perform SQL injection attacks...

SUSE CVE-2026-67319

axios before 0.33.0 and 1.x before 1.18.0 can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth a...