CVE-2026-103913 GeoDirectory <= 2.8.186 - Unauthenticated SQL Injection via 'latitude' Parameter via Stored Pending Listing

The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the stored latitude/longitude coordinates of a listing in versions up to, and including, 2.8.186. This is due to insufficient escaping and the absence of numeric validation on coordinate values when a listing is saved,...

[SECURITY] Fedora 45 Update: prometheus-3.15.0-1.fc45

The Prometheus monitoring system and time series database...

CVE-2026-94539

The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to time-based SQL Injection via the 'sortby' parameter in all versions up to, and including, 3.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-94539 SupportCandy <= 3.5.3 - Authenticated (Custom+) SQL Injection via 'sort_by' Parameter

The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to time-based SQL Injection via the 'sortby' parameter in all versions up to, and including, 3.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient...

EUVD-2026-91875

The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to blind SQL Injection via 'fieldsvalue' Parameter in all versions up to, and including, 2.11.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...

CVE-2026-95865

The Beaver Builder Page Builder plugin for WordPress is vulnerable to blind SQL Injection in all versions up to and including 2.11.0.5 . The root cause is insufficient escaping of the fields[][value] parameter and a lack of sufficient preparation on the existing SQL query. Authenticated attackers...

CVE-2026-95865 Beaver Builder Page Builder <= 2.11.0.5 - Authenticated (Contributor+) SQL Injection via 'fields[][value]' Parameter

The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to blind SQL Injection via 'fieldsvalue' Parameter in all versions up to, and including, 2.11.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...

CVE-2026-95865 Beaver Builder Page Builder <= 2.11.0.5 - Authenticated (Contributor+) SQL Injection via 'fields[][value]' Parameter

The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to blind SQL Injection via 'fieldsvalue' Parameter in all versions up to, and including, 2.11.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...

[SECURITY] Fedora 45 Update: pgmodeler-1.2.2-4.fc45

PostgreSQL Database Modeler, or simply, pgModeler is an open source tool for modeling databases that merges the classical concepts of entity-relationship diagrams with specific features that only PostgreSQL implements. The pgModeler translates the models created by the user to SQL code and apply...

[SECURITY] Fedora 45 Update: osinfo-db-tools-1.12.0-10.fc45

This package provides tools for managing the osinfo database of information about operating systems for use with virtualization...

EUVD-2026-91833

Armatura One's database initialization routine assigns a fixed, vendor-defined password to the database superuser account at creation time, rather than generating a unique password per installation. An individual with access to the server operating system and knowledge of this value can...

PT-2026-104529

Name of the Vulnerable Software and Affected Versions SaveTo Wishlist Lite versions prior to 1.1.5 Description An issue exists where parameters are not sanitized or escaped before being used in the ORDER BY clause of a SQL query. This allows unauthenticated attackers to append additional SQL...

PT-2026-104504

Name of the Vulnerable Software and Affected Versions GeoDirectory versions prior to 2.8.187 Description Insufficient escaping and a lack of numeric validation on coordinate values when saving a listing allow authenticated attackers with Subscriber-level access or higher to perform SQL Injection...

CVE-2026-96267: Improper Neutralization of Special Elements used in an SQL Command

The WP Visitor Statistics Real Time Traffic plugin for WordPress is vulnerable to generic SQL Injection via the 'fullRef' parameter in all versions up to, and including, 8.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...

CVE-2026-18443: Improper Neutralization of Special Elements used in an SQL Command

The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via the 'accessprivileges' parameter in all versions up to, and including, 8.97.0 due to insufficient escaping on the user supplied parameter and lack of sufficien...

CVE-2026-92923: Improper Neutralization of Special Elements used in an SQL Command

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise and escape a parameter before using it in a SQL statement, allowing users with a role as low as subscriber to perform blind SQL injection attacks and read arbitrary data from the database. Version 2.0.18 removed...

CVE-2026-94539: Improper Neutralization of Special Elements used in an SQL Command

The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to time-based SQL Injection via the 'sortby' parameter in all versions up to, and including, 3.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient...

PT-2026-104486

The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to blind SQL Injection via 'fieldsvalue' Parameter in all versions up to, and including, 2.11.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...

PT-2026-104542

Name of the Vulnerable Software and Affected Versions The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management versions prior to 8.97.1 Description An issue exists where authenticated attackers with subscriber-level access and above can perform a generic SQL Injection. This occur...

CVE-2026-94592

Armatura One's database initialization routine assigns a fixed, vendor-defined password to the database superuser account at creation time, rather than generating a unique password per installation. An individual with access to the server operating system and knowledge of this value can...