264206 matches found
EUVD-2026-96025
In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions...
CVE-2026-108474
In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions...
OrdaSoft Joomla CCK 8.3.15 SQL Injection
OrdaSoft Joomla CCK versions 1.0.0 through 8.3.15 contain an unauthenticated SQL injection vulnerability in record sorting. A proof of concept is included. https://packetstorm.news/download/235077...
PT-2026-109837
Name of the Vulnerable Software and Affected Versions Barcode Scanner with Inventory & Order Manager versions prior to 1.13.2 Description An SQL Injection issue exists in the subscriber component, allowing an attacker to interfere with the application's database queries. Recommendations Update...
PT-2026-109777
Name of the Vulnerable Software and Affected Versions Qode Tours versions prior to 3.1.3.3 Description An issue exists that allows for SQL Injection, a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database...
PT-2026-109787
Name of the Vulnerable Software and Affected Versions WP Ultimate CSV Importer versions prior to 9.3 Description An SQL Injection issue exists that allows an administrator to execute malicious SQL queries. This occurs when the application fails to properly sanitize input used in database queries...
PT-2026-109783
Name of the Vulnerable Software and Affected Versions Frontend Admin by DynamiApps versions prior to 3.29.14 Description An SQL Injection issue exists in the administrator section, allowing an attacker to interfere with the queries that an application makes to its database. Recommendations Update...
PT-2026-109534
The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...
PT-2026-109506
The Rank Math SEO WordPress plugin before 1.0.280 does not properly sanitise and escape a parameter before using it in a SQL query, allowing high-privilege users such as administrators to perform SQL injection attacks...
PT-2026-109500
The Smart Popup by Supsystic plugin for WordPress is vulnerable to generic SQL Injection via the 'sidx' parameter in all versions up to, and including, 1.13.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...
PT-2026-109553
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the 'current month' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQ...
PT-2026-109606
The WP Directory Kit plugin for WordPress is vulnerable to time-based SQL Injection via 'display name' Profile Field Second-Order in all versions up to, and including, 1.5.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...
PT-2026-109607
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection via 'bookingservice id' Parameter in all versions up to, and including, 5.7.2 due to insufficient escaping on the user supplied parameter and lack of...
PT-2026-109798
Name of the Vulnerable Software and Affected Versions uListing versions prior to 2.2.1 Description An unauthenticated SQL Injection exists in the software. SQL Injection is a type of vulnerability that allows an attacker to interfere with the queries that an application makes to its database,...
PT-2026-109700
Name of the Vulnerable Software and Affected Versions Tickera tickera-event-ticketing-system versions prior to 3.6.0.6 Description An improper neutralization of special elements used in an SQL command allows for Blind SQL Injection. Blind SQL Injection is a technique where an attacker asks the...
PT-2026-109756
Name of the Vulnerable Software and Affected Versions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes versions prior to 1.5.4 Description A SQL Injection issue exists that allows a user with subscriber privileges to execute unauthorized database queries. Recommendations Update...
CVE-2026-104753: Improper Neutralization of Special Elements used in an SQL Command
The Rank Math SEO WordPress plugin before 1.0.280 does not properly sanitise and escape a parameter before using it in a SQL query, allowing high-privilege users such as administrators to perform SQL injection attacks...
CVE-2026-104023: Improper Neutralization of Special Elements used in an SQL Command
The Smart Popup by Supsystic plugin for WordPress is vulnerable to generic SQL Injection via the 'sidx' parameter in all versions up to, and including, 1.13.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...
CVE-2026-104724: Improper Neutralization of Special Elements used in an SQL Command
The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to generic SQL Injection via FireBox Form Display Condition in all versions up to, and including, 3.1.13 due to insufficient escaping on the user supplied parameter and la...