PT-2026-113626

The Gmedia Photo Gallery plugin for WordPress is vulnerable to time-based SQL Injection via the 'gmedia in' parameter in all versions up to, and including, 1.25.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes i...

PT-2026-113602

The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'validate' parameter in all versions up to, and including, 10.8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...

PT-2026-113689

Name of the Vulnerable Software and Affected Versions WMS MobileServer affected versions not specified Description The authorization middleware fails to enforce authentication in two scenarios. First, authentication is only required for GET and HEAD requests, meaning other HTTP methods are...

PT-2026-113610

The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart persistent meta value in all versions up to, and including, 10.8.0 due to insufficient escaping on user supplied data and lack of sufficient preparation on the existing SQL query in the...

PT-2026-113961

Name of the Vulnerable Software and Affected Versions Nessus affected versions not specified Description An SQL injection allows an authenticated user to read or modify data stored by the system. SQL injection is a technique where malicious SQL statements are inserted into entry fields for...

CVE-2026-103946: Improper Neutralization of Special Elements used in an SQL Command

An SQL injection vulnerability could allow an authenticated user to read or modify data stored by Nessus...

CVE-2026-89076: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Progress MOVEit Transfer Custom Reports module. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

PT-2026-114328

Name of the Vulnerable Software and Affected Versions MOVEit Transfer versions prior to 2025.1.6 MOVEit Transfer versions 2026.0.0 through 2026.0.3 Description An SQL injection issue exists within the Custom Reports module. This occurs due to the improper neutralization of special elements used i...

RHEL 8 : mariadb-connector-c (RHSA-2026:83080)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:83080 advisory. The MariaDB Native Client library C driver is used to connect applications developed in C/C++ to MariaDB and MySQL databases. Security Fixes: mariad...

PT-2026-113624

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via the 'inputs' parameter in all versions up to, and including, 1.15.48 due to insufficient escaping on the user supplied parameter and lack of sufficient...

PT-2026-113688

The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database...

PT-2026-113618

The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via 'product.push' Identity Endpoint in all versions up to, and including, 2.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...

CVE-2026-63165

Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject malicious SQL by manipulating the sortEvents parameter, which is concatenated into the ORDER BY clause without sanitization in...

CVE-2026-63152

Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability that allows authenticated attackers to inject malicious SQL via the idCategoryFilter parameter, which is persisted into the session and later concatenated into a SQL statement without parameterization...

CVE-2026-63146

Omnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, attacker-controlled values are written into the config.inc.php configuration file during installation through File::updateConfigFile and DbInstall::dbControl, combined with an SQL injection issue enabl...

CVE-2026-110083

Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized...

CVE-2026-63165

The Omnispace Agora Project version prior to 26.10.0 is vulnerable to a SQL injection flaw within its calendar functionality. The root cause is the lack of sanitization for the sortEvents parameter, which is directly concatenated into an ORDER BY clause in the app/ModCalendar/CtrlCalendar.php fil...

CVE-2026-63165 Omnispace Agora Project < 26.10.0 SQL Injection via sortEvents Parameter

Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject malicious SQL by manipulating the sortEvents parameter, which is concatenated into the ORDER BY clause without sanitization in...

CVE-2026-63165 Omnispace Agora Project < 26.10.0 SQL Injection via sortEvents Parameter

Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject malicious SQL by manipulating the sortEvents parameter, which is concatenated into the ORDER BY clause without sanitization in...

CVE-2026-63152 Omnispace Agora Project < 26.10.0 Second-Order SQL Injection via _idCategoryFilter

Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability that allows authenticated attackers to inject malicious SQL via the idCategoryFilter parameter, which is persisted into the session and later concatenated into a SQL statement without parameterization...