CVE-2026-81420 Tcard WP <= 1.8.0 - Unauthenticated SQLi via group_id Parameter

The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it in a SQL statement in one of its unauthenticated AJAX actions, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-81420 Tcard WP <= 1.8.0 - Unauthenticated SQLi via group_id Parameter

The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it in a SQL statement in one of its unauthenticated AJAX actions, allowing unauthenticated users to perform SQL injection attacks...

EUVD-2026-96737

The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-103695

The Mobile builder WordPress plugin versions up to and including 1.4.2 is vulnerable to an unauthenticated SQL injection attack. The root cause is the failure to properly sanitize and escape the 'vendor_id' parameter before its use in a SQL statement. This flaw allows unauthorized users to execut...

CVE-2026-103695 Mobile Builder <= 1.4.2 - Unauthenticated SQLi via 'vendor_id' Parameter

The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks...

andor

andor Herramienta de inyección SQL ciega con Golang Uso Descarga andor.go y ve a la carpeta donde se encuentra el archivo andor.go. Luego escribe esto en el símbolo del sistema: go run andor.go --url "http://deneme.com/index.php?id=1" Nota: El valor del parámetro Get debe ser correcto, de lo...

php_code_analysis

este script analizará tu código el script puede encontrar 1. problemas de carga de archivos checkfileupload 2. inyección en cabecera de host hostheaderinjection 3. inyección SQL 4. deserialización insegura insecure deserialization 5. redirección abierta openredirect 6. SSRF 7. XSS 8. LFI 9...

lazyrecon

| | | |/ | /| | | | / / |/ | \ | | | / / | | | | | | / | | | ||\ |/ \ || ||/|| |v2 |/ Lazyrecon v2 es una herramienta de descubrimiento de subdominios que encuentra y resuelve subdominios válidos y luego realiza fuzzing de SSRF/LFI/SQLi, fuerza bruta y escaneo de puertos. Tiene una...

sqlmc

SQLMC - Controllo Massivo di SQL Injection Demo Informazioni Questo strumento è solo per scopi educativi, l'uso di SQLMC per attaccare target senza il preventivo consenso reciproco è illegale. Gli sviluppatori non si assumono alcuna responsabilità e non sono responsabili per qualsiasi uso impropr...

tulpar

Tulpar es un escáner de vulnerabilidades web de código abierto diseñado para automatizar las pruebas de penetración web. Tulpar tiene las siguientes características. Sql Injection GET Method XSS GET Method Crawl E-mail Disclosure Credit Card Disclosure Whois Command Injection GET Method Directory...

webpwn3r

webpwn3r Questo progetto non è mantenuto da anni ed è stato scritto quando stavo imparando Python, ma ancora oggi piace alla gente :D. Supporta solo python2.7 WebPwn3r - Scanner di sicurezza per applicazioni web. Di Ebrahim Hegazy - @Zigoo0 Ringraziamenti: @lnxg33k, @dia2diab @Aelhemily, @okamalo...

testenv

Entorno de pruebas de inyección SQL Una colección de páginas web vulnerables a fallos de inyección SQL y más: conf/ - archivos de configuración del sistema operativo utilizados por deployment.sh. dbs/ - bases de datos independientes para algunos sistemas de gestión de bases de datos p. ej...

w3af

sqlmap sqlmap es una herramienta para pruebas de penetración "penetration testing" de software libre que automatiza el proceso de detección y explotación de fallos mediante inyección de SQL además de tomar el control de servidores de bases de datos. Contiene un poderoso motor de detección, así co...

PT-2026-110061

Name of the Vulnerable Software and Affected Versions Loja Automática versions prior to 1.0.1 Description Unauthenticated users can perform SQL injection attacks because the plugin fails to properly sanitize and escape the id parameter before incorporating it into a SQL query. SQL injection is a...

PT-2026-110010

Name of the Vulnerable Software and Affected Versions Mobile builder WordPress plugin versions prior to 1.4.3 Description Unauthenticated users can perform SQL injection attacks because the plugin fails to sanitize and escape a parameter before incorporating it into a SQL statement. SQL injection...

CVE-2026-89305: Improper Neutralization of Special Elements used in an SQL Command

The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to perform SQL injection attacks...

CVE-2026-89232: Improper Neutralization of Special Elements used in an SQL Command

The Recordbrowser WordPress plugin through 1.1.7 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database...

CVE-2026-108571: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6. This impacts the function kqjcmdModel::returnchuli of the file webmain/task/openapi/openkqjAction.php of the component Openkqj Action. This manipulation of the argument ID causes sql injection. The attack is possible to be carri...

CVE-2026-108684: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in erzhongxmu Jeewms up to 3.7. This affects the function getTreeData of the file src/main/java/com/jeecg/demo/controller/JeecgFormDemoController.java of the component Autocomplete Data Handler. Performing a manipulation of the argument searchVal results in sql...

PT-2026-110103

Name of the Vulnerable Software and Affected Versions Xinhu Rainrock RockOA versions prior to 2.7.7 Description A remote SQL injection exists within the Openkqj Action component. The issue occurs in the kqjcmdModel::returnchuli function located in the webmain/task/openapi/openkqjAction.php file. ...