262133 matches found
CVE-2026-92997
The Click n Chat (Chat Widget Integration) WordPress plugin, in versions prior to 1.1.3 , is vulnerable to SQL injection . The root cause is the improper validation of a parameter used as a column identifier within a SQL query. This flaw allows unauthenticated attackers to perform SQL injection a...
CVE-2026-92997 Click n Chat < 1.1.3 - Unauthenticated SQLi via 'datacolumn' Parameter
The Click n Chat Chat Widget Integration WordPress plugin before 1.1.3 does not properly validate a parameter before using it as a column identifier in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks...
CVE-2026-92998 Click n Chat 1.0.4 - 1.1.2 - Unauthenticated SQLi via 'sort_by'/'sort_order' Parameters
The Click n Chat Chat Widget Integration WordPress plugin before 1.1.3 does not sanitise sort parameters before using them in a SQL ORDER BY clause, allowing unauthenticated attackers to perform SQL injection attacks...
CVE-2026-92998 Click n Chat 1.0.4 - 1.1.2 - Unauthenticated SQLi via 'sort_by'/'sort_order' Parameters
The Click n Chat Chat Widget Integration WordPress plugin before 1.1.3 does not sanitise sort parameters before using them in a SQL ORDER BY clause, allowing unauthenticated attackers to perform SQL injection attacks...
EUVD-2026-107089
The Click n Chat Chat Widget Integration WordPress plugin before 1.1.3 does not properly validate a parameter before using it as a column identifier in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks...
EUVD-2026-107043
The Click n Chat Chat Widget Integration WordPress plugin before 1.1.3 does not sanitise sort parameters before using them in a SQL ORDER BY clause, allowing unauthenticated attackers to perform SQL injection attacks...
CVE-2026-92997 Click n Chat < 1.1.3 - Unauthenticated SQLi via 'datacolumn' Parameter
The Click n Chat Chat Widget Integration WordPress plugin before 1.1.3 does not properly validate a parameter before using it as a column identifier in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks...
CVE-2026-92998
The Click n Chat (Chat Widget Integration) WordPress plugin versions before 1.1.3 is vulnerable to SQL injection . The root cause is the failure to sanitise sort parameters before they are used in a SQL ORDER BY clause. This flaw allows unauthenticated attackers to perform SQL injection attacks, ...
CVE-2026-110651 Swift Performance Lite < 2.3.7.4 - Author+ SQLi via Image Optimizer
The Swift Performance Lite WordPress plugin before 2.3.7.4 does not properly sanitize and escape a value before using it in a SQL statement, which could allow users with the author role and above to perform SQL injection attacks...
EUVD-2026-107070
The Swift Performance Lite WordPress plugin before 2.3.7.4 does not properly sanitize and escape a value before using it in a SQL statement, which could allow users with the author role and above to perform SQL injection attacks...
CVE-2026-110651 Swift Performance Lite < 2.3.7.4 - Author+ SQLi via Image Optimizer
The Swift Performance Lite WordPress plugin before 2.3.7.4 does not properly sanitize and escape a value before using it in a SQL statement, which could allow users with the author role and above to perform SQL injection attacks...
CVE-2026-110651
The Swift Performance Lite WordPress plugin (versions before 2.3.7.4 ) is vulnerable to SQL injection because it fails to properly sanitize and escape a value before utilizing it in a SQL statement. This vulnerability specifically affects users with the author role and above, who could potentiall...
CVE-2026-102499
The Modern Events Calendar Lite and Modern Event Calendar Pro WordPress plugins, in versions before 7.37.0 , are vulnerable to SQL Injection via the mec_attendees AJAX Action . The root cause is the failure to properly sanitise and escape a parameter used within a SQL statement. This allows authe...
CVE-2026-102499 Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_attendees AJAX Action
The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL...
CVE-2026-102499 Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_attendees AJAX Action
The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL...
EUVD-2026-107049
The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL...
CVE-2023-40933-PoC
CVE-2023-40933 The sqlmap payload to exploit CVE-2023-40933 Payload Required Information: Valid Username and Password Domain and path of hosted instance sqlmap -D nagiosxi -T xiusers -u "https:///nagiosxi/admin/bannermessage-ajaxhelper.php?action=updatebannermessagesettings&id=3&token=curl -ksX...
DjVul_StringAgg
Django CVE-2020-7471 SQLi CVE-2020-7471: Potential SQL injection via StringAggdelimiter django.contrib.postgres.aggregates.StringAgg aggregation function was subject to SQL injection, using a suitably crafted delimiter. RUN python manage.py makemigrations python manage.py migrate python manage.py...
CVE-2024-3217-POC
CVE-2024-3217-POC Mitre Description The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'attributevalue' and 'attributeid' parameters in all versions up to, and including, 1.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...
CVE-2026-7229-SQLI
Authenticated SQL Injection in Coaching Management System Allows Database Dump Description A SQL Injection vulnerability exists in the Coaching Management System in PHP. The complaintreply parameter in the admin reply functionality is not properly sanitized before being used in SQL queries. An...