CVE-2026-19710

CVE-2026-19710 affects SourceCodester Simple Student Information System. Affected vulnerability is in the admin/departments/view_department.php function where manipulating the ID parameter enables SQL injection, with a remote attack vector and PoC exploit publicly available. The vulnerability’s e...

[R1] Security Center Version 6.9.0 Fixes Multiple Vulnerabilities

R1 Security Center Version 6.9.0 Fixes Multiple Vulnerabilities Arnie Cabral Thu, 08/13/2026 - 10:35 Security Center leverages third-party software to help provide underlying functionality. Several of the third-party components curl, underscoreJS were found to contain vulnerabilities, and updated...

CVE-2026-73346

Administrator SQL Injection in MailChimp For WooCommerce 6.2 versions...

CVE-2026-66658

Subscriber SQL Injection in Reviewer = 3.14.2 versions...

CVE-2026-66472

Unauthenticated SQL Injection in Everest Backup = 2.3.12 versions...

CVE-2026-66478

Unauthenticated SQL Injection in Church Admin = 5.1.1 versions...

CVE-2026-66458

Unauthenticated SQL Injection in RealPress = 1.1.2 versions...

CVE-2026-66446

Subscriber SQL Injection in If-So Dynamic Content Personalization = 1.10 versions...

CVE-2026-66436

Unauthenticated SQL Injection in Active Products Tables for WooCommerce = 1.1.1 versions...

CVE-2026-66430

Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.10 versions...

CVE-2026-61969

Unauthenticated SQL Injection in Listdom = 5.6.0 versions...

CVE-2026-61966

Subscriber SQL Injection in WPJAM Basic = 7.0.1 versions...

CVE-2026-28184

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-28168

Subscriber SQL Injection in CubeWP = 1.1.30 versions...

CVE-2026-28156

Subscriber SQL Injection in Do Lasso = 358 versions...

CVE-2026-28002

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22...

CVE-2026-28142

Unauthenticated SQL Injection in Web Directory Free = 1.7.13 versions...

CVE-2026-28001

Unauthenticated SQL Injection in WP Directory Kit = 1.5.4 versions...

CVE-2026-27538

Unauthenticated SQL Injection in WP Directory Kit = 1.5.4 versions...

Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name

Summary A missing end anchor $ in the ClassDefinition UID validation regex allows an authenticated user with the objects permission to create a class with a malicious UID containing SQL. When a data object of that class is later loaded, Block.php concatenates the raw classId directly into a SQL...