262676 matches found
CVE-2026-102158: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Improper validation of selected CloudVision CUE application programming interface API request parameters may allow an authenticated network user to perform SQL injection against the backend impacting its availability...
PT-2026-106758
A vulnerability was identified in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This affects an unknown function of the file search class.php. Such manipulation of the argument school year leads to sql injection. The attack may be launched remotely. The...
PT-2026-106389
Subscriber SQL Injection in Paid Member Subscriptions = 3.1.1 versions...
WP < 7.1.3 - Author+ SQLi via WXR Export
Description WordPress does not properly validate some post meta values before using them in a database query when exporting content in some cases, which could allow users with Author-level access and above to store a crafted value that results in SQL injection executed when an administrator later...
PT-2026-106461
Unauthenticated SQL Injection in SendPress Newsletters = 1.26.1.20 versions...
PT-2026-106728
Name of the Vulnerable Software and Affected Versions Kusalkasilva Learning-Management-System versions up to ffeb873f8803f1e9664384ff75000c7da45466d2 Description A remote SQL injection exists within the Student Registration Endpoint component, specifically affecting an unknown function in the...
PT-2026-106453
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Serhii Pasyuk Gmedia Photo Gallery grand-media allows Blind SQL Injection.This issue affects Gmedia Photo Gallery: from n/a through 1.25.1...
CVE-2026-79798: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow a low-privileged authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to run arbitra...
CVE-2026-41555: Improper Neutralization of Special Elements used in an SQL Command
Unauthenticated SQL Injection in Newsletter Subscription Form – User Subscriptions Form, Capture Email = 1.5.9 versions...
PT-2026-106395
Name of the Vulnerable Software and Affected Versions WooCommerce Appointments versions prior to 5.3.3 Description An unauthenticated SQL Injection exists in the software. SQL Injection is a type of vulnerability that allows an attacker to interfere with the queries that an application makes to i...
CVE-2026-25434: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in WP2LEADS = 3.5.7 versions...
CVE-2026-76754: Improper Neutralization of Special Elements used in a Command
A vulnerability in an affected interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to run arbitrary database commands...
PT-2026-106335
A flaw has been found in bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL up to ae783195ba7e0390d3b3bfaddd99944b7e9735a4. Affected by this vulnerability is an unknown functionality of the file /admin transaction.php. This manipulation of the argument Username causes sql...
PT-2026-106406
Name of the Vulnerable Software and Affected Versions WooCommerce Lottery versions prior to 2.3.0 Description An unauthenticated SQL Injection exists in the software. SQL Injection is a type of vulnerability that allows an attacker to interfere with the queries that an application makes to its...
PT-2026-106476
Unauthenticated SQL Injection in ARMember Premium = 7.8 versions...
PT-2026-106719
A vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The affected element is the function mysql query of the file admin/login.php of the component Administrator Login Endpoint. The manipulation of the argument username/password resul...
PT-2026-106475
Subscriber SQL Injection in UDesign Core = 4.15.0 versions...
PT-2026-106473
Subscriber SQL Injection in ListingPro = 2.9.12 versions...
CVE-2026-105472: Improper Neutralization of Special Elements used in an SQL Command
A weakness has been identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. The affected element is an unknown function of the file book.php of the component Booking Handler. This manipulation of the argument Doctor/appointment causes sql...