CVE-2026-89232 RecordBrowser <= 1.1.7 - Unauthenticated SQLi via 'recordid' Parameter

The Recordbrowser WordPress plugin through 1.1.7 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database...

CVE-2026-89285 Datalist it <= 0.0.3 - Unauthenticated SQLi via dli_fronted_action

The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several request parameters before using them to build a SQL query, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database...

CVE-2026-89214 WpCues Basic Quiz <= 1.6.5 - Unauthenticated SQLi via Quiz Result Submission

The WpCues Basic Quiz WordPress plugin through 1.6.5 does not properly sanitise and escape values before using them in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database...

CVE-2026-89214 WpCues Basic Quiz <= 1.6.5 - Unauthenticated SQLi via Quiz Result Submission

The WpCues Basic Quiz WordPress plugin through 1.6.5 does not properly sanitise and escape values before using them in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database...

CVE-2026-89195 Site Setup Wizard <= 1.5.8 - Unauthenticated SQLi via ssw_check_admin_email_exists

The Site Setup Wizard WordPress plugin through 1.5.8 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database...

CVE-2026-89195

The Site Setup Wizard WordPress plugin, in versions up to and including 1.5.8 , is vulnerable to an unauthenticated SQL injection attack. The root cause is the improper sanitization and escaping of a parameter before its use in a SQL statement, specifically within the ssw_check_admin_email_exists...

EUVD-2026-96780

The Site Setup Wizard WordPress plugin through 1.5.8 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database...

EUVD-2026-96779

The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requests authorised by it, and does not sanitise and escape a parameter before using it in an SQL statement, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-89195 Site Setup Wizard <= 1.5.8 - Unauthenticated SQLi via ssw_check_admin_email_exists

The Site Setup Wizard WordPress plugin through 1.5.8 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database...

CVE-2026-88930 Social Web Suite <= 4.1.12 - Unauthenticated Blind SQLi via Unset Shared Secret

The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requests authorised by it, and does not sanitise and escape a parameter before using it in an SQL statement, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-81420 Tcard WP <= 1.8.0 - Unauthenticated SQLi via group_id Parameter

The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it in a SQL statement in one of its unauthenticated AJAX actions, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-81420

The Tcard WP WordPress plugin, in versions through 1.8.0 , is vulnerable to SQL injection because it fails to sanitize and escape a parameter—specifically the group_id parameter—before using it in a SQL statement within an unauthenticated AJAX action. This flaw allows unauthenticated users to per...

EUVD-2026-96751

The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it in a SQL statement in one of its unauthenticated AJAX actions, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-81420 Tcard WP <= 1.8.0 - Unauthenticated SQLi via group_id Parameter

The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it in a SQL statement in one of its unauthenticated AJAX actions, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-103695 Mobile Builder <= 1.4.2 - Unauthenticated SQLi via 'vendor_id' Parameter

The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-103695

The Mobile builder WordPress plugin versions up to and including 1.4.2 is vulnerable to an unauthenticated SQL injection attack. The root cause is the failure to properly sanitize and escape the 'vendor_id' parameter before its use in a SQL statement. This flaw allows unauthorized users to execut...

EUVD-2026-96737

The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-103695 Mobile Builder <= 1.4.2 - Unauthenticated SQLi via 'vendor_id' Parameter

The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks...

andor

andor Herramienta de inyección SQL ciega con Golang Uso Descarga andor.go y ve a la carpeta donde se encuentra el archivo andor.go. Luego escribe esto en el símbolo del sistema: go run andor.go --url "http://deneme.com/index.php?id=1" Nota: El valor del parámetro Get debe ser correcto, de lo...

php_code_analysis

este script analizará tu código el script puede encontrar 1. problemas de carga de archivos checkfileupload 2. inyección en cabecera de host hostheaderinjection 3. inyección SQL 4. deserialización insegura insecure deserialization 5. redirección abierta openredirect 6. SSRF 7. XSS 8. LFI 9...