262436 matches found
PT-2026-110025
Name of the Vulnerable Software and Affected Versions Tcard WP versions prior to 1.8.1 Description The plugin fails to sanitize and escape a parameter used in a SQL statement within an unauthenticated AJAX action. This allows unauthenticated users to execute SQL injection attacks, which involve...
PT-2026-110062
Name of the Vulnerable Software and Affected Versions WP Verify API versions prior to 1.0.1 Description Unauthenticated users can perform SQL injection attacks because the plugin fails to properly sanitize and escape the verify parameter before incorporating it into a SQL query. SQL injection is ...
CVE-2026-89234: Improper Neutralization of Special Elements used in an SQL Command
The WP-Partner WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database...
CVE-2026-89214: Improper Neutralization of Special Elements used in an SQL Command
The WpCues Basic Quiz WordPress plugin through 1.6.5 does not properly sanitise and escape values before using them in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database...
CVE-2026-89304: Improper Neutralization of Special Elements used in an SQL Command
The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform blind SQL injection attacks...
CVE-2026-89297: Improper Neutralization of Special Elements used in an SQL Command
The Loja Automática WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...
CVE-2026-59508: Improper Neutralization of Special Elements used in an SQL Command
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Interuse i-Bos. This issue affects i-Bos: 3.0...
CVE-2026-108569: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was identified in Furion .NET Framework up to 4.9.9.92. The impacted element is the function String.Replace of the file framework/Furion/Templates/Extensions/StringRenderExtensions.cs. The manipulation of the argument Name leads to sql injection. Remote exploitation of the attack ...
CVE-2026-62117
Subscriber SQL Injection in Barcode Scanner with Inventory & Order Manager = 1.13.1 versions...
CVE-2026-62031
Unauthenticated SQL Injection in uListing = 2.2.0 versions...
CVE-2026-42722
Administrator SQL Injection in Frontend Admin by DynamiApps = 3.29.13 versions...
CVE-2026-45440
Administrator SQL Injection in WP Ultimate CSV Importer = 9.2 versions...
CVE-2026-42712
Subscriber SQL Injection in Qode Tours = 3.1.3.2 versions...
CVE-2026-42717
Administrator SQL Injection in Leyka = 3.32.3 versions...
CVE-2026-42633
Subscriber SQL Injection in Events Manager = 7.4.6 versions...
CVE-2026-40800
Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes = 1.5.3 versions...
CVE-2026-108604
Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP runquery safety gate that allows prompt-injected agents or untrusted MCP clients to bypass read-only mode by submitting side-effecting SELECT statements. Attackers can run statements like SELECT setval, nextval,...
CVE-2026-108604 Tabularis through 0.27.0 Read-Only Bypass via MCP run_query SELECT Classification
Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP runquery safety gate that allows prompt-injected agents or untrusted MCP clients to bypass read-only mode by submitting side-effecting SELECT statements. Attackers can run statements like SELECT setval, nextval,...
