EUVD-2026-58068

A vulnerability was found in SourceCodester Simple Student Information System. Affected by this vulnerability is an unknown functionality of the file app/admin/departments/viewdepartment.php. Performing a manipulation of the argument ID results in sql injection. The attack is possible to be carri...

CVE-2026-19710

CVE-2026-19710 affects SourceCodester Simple Student Information System. Affected vulnerability is in the admin/departments/view_department.php function where manipulating the ID parameter enables SQL injection, with a remote attack vector and PoC exploit publicly available. The vulnerability’s e...

CVE-2026-73346

Administrator SQL Injection in MailChimp For WooCommerce 6.2 versions...

CVE-2026-66658

Subscriber SQL Injection in Reviewer = 3.14.2 versions...

CVE-2026-66472

Unauthenticated SQL Injection in Everest Backup = 2.3.12 versions...

CVE-2026-66478

Unauthenticated SQL Injection in Church Admin = 5.1.1 versions...

CVE-2026-66458

Unauthenticated SQL Injection in RealPress = 1.1.2 versions...

CVE-2026-66446

Subscriber SQL Injection in If-So Dynamic Content Personalization = 1.10 versions...

CVE-2026-66436

Unauthenticated SQL Injection in Active Products Tables for WooCommerce = 1.1.1 versions...

CVE-2026-66430

Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.10 versions...

CVE-2026-61969

Unauthenticated SQL Injection in Listdom = 5.6.0 versions...

CVE-2026-61966

Subscriber SQL Injection in WPJAM Basic = 7.0.1 versions...

CVE-2026-28184

Subscriber SQL Injection in Form Maker by 10Web = 1.15.44 versions...

CVE-2026-28168

Subscriber SQL Injection in CubeWP = 1.1.30 versions...

CVE-2026-28156

Subscriber SQL Injection in Do Lasso = 358 versions...

CVE-2026-28002

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22...

CVE-2026-28142

Unauthenticated SQL Injection in Web Directory Free = 1.7.13 versions...

CVE-2026-28001

Unauthenticated SQL Injection in WP Directory Kit = 1.5.4 versions...

CVE-2026-27538

Unauthenticated SQL Injection in WP Directory Kit = 1.5.4 versions...

Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name

Summary A missing end anchor $ in the ClassDefinition UID validation regex allows an authenticated user with the objects permission to create a class with a malicious UID containing SQL. When a data object of that class is later loaded, Block.php concatenates the raw classId directly into a SQL...