264188 matches found
CVE-2026-89234: Improper Neutralization of Special Elements used in an SQL Command
The WP-Partner WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database...
CVE-2026-89232: Improper Neutralization of Special Elements used in an SQL Command
The Recordbrowser WordPress plugin through 1.1.7 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database...
CVE-2026-89214: Improper Neutralization of Special Elements used in an SQL Command
The WpCues Basic Quiz WordPress plugin through 1.6.5 does not properly sanitise and escape values before using them in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database...
CVE-2026-89213: Improper Neutralization of Special Elements used in an SQL Command
The Llavero.io WordPress plugin through 0.1.4 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database...
CVE-2026-88930: Improper Neutralization of Special Elements used in an SQL Command
The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requests authorised by it, and does not sanitise and escape a parameter before using it in an SQL statement, allowing unauthenticated users to perform SQL injection attacks...
itsourcecode Leave Management System 1.0 SQL Injection
itsourcecode Leave Management System version 1.0 contains a SQL injection vulnerability in the LEAVEID parameter of /module/leave/controller.php...
PT-2026-110350
Name of the Vulnerable Software and Affected Versions erzhongxmu JEEWMS versions prior to 2026.09.27-W39 Description A remote SQL injection is possible through the manipulation of the goodscode argument within the docheck function of the...
PT-2026-110103
Name of the Vulnerable Software and Affected Versions Xinhu Rainrock RockOA versions prior to 2.7.7 Description A remote SQL injection exists within the Openkqj Action component. The issue occurs in the kqjcmdModel::returnchuli function located in the webmain/task/openapi/openkqjAction.php file. ...
FreePBX Endpoint Manager 17.0.2 Unauthenticated SQL Injection
FreePBX Endpoint Manager versions prior to 15.0.66, 16.0.89, and 17.0.3 contain an unauthenticated SQL injection that allows database modification and remote command execution through scheduled jobs. https://packetstorm.news/download/235109...
CVE-2026-59508: Improper Neutralization of Special Elements used in an SQL Command
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Interuse i-Bos. This issue affects i-Bos: 3.0...
CVE-2026-108569: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was identified in Furion .NET Framework up to 4.9.9.92. The impacted element is the function String.Replace of the file framework/Furion/Templates/Extensions/StringRenderExtensions.cs. The manipulation of the argument Name leads to sql injection. Remote exploitation of the attack ...
CVE-2026-108571: Improper Neutralization of Special Elements used in an SQL Command
A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6. This impacts the function kqjcmdModel::returnchuli of the file webmain/task/openapi/openkqjAction.php of the component Openkqj Action. This manipulation of the argument ID causes sql injection. The attack is possible to be carri...
CVE-2026-108684: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was detected in erzhongxmu Jeewms up to 3.7. This affects the function getTreeData of the file src/main/java/com/jeecg/demo/controller/JeecgFormDemoController.java of the component Autocomplete Data Handler. Performing a manipulation of the argument searchVal results in sql...
Exploit for CVE-2026-102428
CVE-2026-102428 — OrdaSoft OS CCK comoscck unauthenticated...
CVE-2026-62117
Subscriber SQL Injection in Barcode Scanner with Inventory & Order Manager = 1.13.1 versions...
CVE-2026-62031
Unauthenticated SQL Injection in uListing = 2.2.0 versions...
CVE-2026-42722
Administrator SQL Injection in Frontend Admin by DynamiApps = 3.29.13 versions...
CVE-2026-45440
Administrator SQL Injection in WP Ultimate CSV Importer = 9.2 versions...