CVE-2026-104456 YesWiki before 4.6.7 Second-Order SQL Injection via ACL Username

YesWiki before 4.6.7 contains a second-order SQL injection vulnerability in AclService::updateRequestWithACL, where a stored username is concatenated unescaped into a read-ACL LIKE clause. Attackers can self-register an account name containing a double-quote payload, then load non-admin...

CVE-2026-104456 YesWiki before 4.6.7 Second-Order SQL Injection via ACL Username

YesWiki before 4.6.7 contains a second-order SQL injection vulnerability in AclService::updateRequestWithACL, where a stored username is concatenated unescaped into a read-ACL LIKE clause. Attackers can self-register an account name containing a double-quote payload, then load non-admin...

CVE-2026-104456 YesWiki before 4.6.7 Second-Order SQL Injection via ACL Username

YesWiki before 4.6.7 contains a second-order SQL injection vulnerability in AclService::updateRequestWithACL, where a stored username is concatenated unescaped into a read-ACL LIKE clause. Attackers can self-register an account name containing a double-quote payload, then load non-admin...

CVE-2026-104410

Versions of SiYuan prior to 3.8.5 are vulnerable to an information disclosure flaw involving the /api/export/preview endpoint. This vulnerability allows readers of published content to access password-protected and publish-disabled database rows. Specifically, an attacker can request an export pr...

CVE-2026-104410 SiYuan before 3.8.5 Information Disclosure via /api/export/preview

SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish readers to read password-protected and publish-disabled database rows via the /api/export/preview endpoint. Attackers can request an export preview of a public document embedding a database view to obtain...

CVE-2026-104410 SiYuan before 3.8.5 Information Disclosure via /api/export/preview

SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish readers to read password-protected and publish-disabled database rows via the /api/export/preview endpoint. Attackers can request an export preview of a public document embedding a database view to obtain...

EUVD-2026-91421

SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish readers to read password-protected and publish-disabled database rows via the /api/export/preview endpoint. Attackers can request an export preview of a public document embedding a database view to obtain...

CVE-2026-104410 SiYuan before 3.8.5 Information Disclosure via /api/export/preview

SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish readers to read password-protected and publish-disabled database rows via the /api/export/preview endpoint. Attackers can request an export preview of a public document embedding a database view to obtain...

CVE-2026-12951

The Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the /multivendorx/v1/compliance/report-abuse REST endpoint in versions up to and including 5.0.18. This is due to insufficient escaping on the user supplied parameter and lack of...

EUVD-2026-91256

The Event Tickets and Registration plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.29.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2026-97634 Event Tickets and Registration <= 5.29.5 - Authenticated (Contributor+) SQL Injection via 'orderby' Parameter

The Event Tickets and Registration plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.29.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2026-97634 Event Tickets and Registration <= 5.29.5 - Authenticated (Contributor+) SQL Injection via 'orderby' Parameter

The Event Tickets and Registration plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.29.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2026-12951 MultiVendorX <= 5.0.18 - Authenticated (Store Manager+) SQL Injection via 'order_by' Parameter

The Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the /multivendorx/v1/compliance/report-abuse REST endpoint in versions up to and including 5.0.18. This is due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-94298

The BuildKit WordPress plugin before 1.0.29 does not properly sanitise and escape data submitted by contributor-level users before storing it and later using it in a SQL query, allowing a Contributor to inject SQL that runs against the database once the resulting content is published and viewed b...

CVE-2026-94298 BuildKit < 1.0.29 - Contributor+ Stored SQLi via list_content Parameter

The BuildKit WordPress plugin before 1.0.29 does not properly sanitise and escape data submitted by contributor-level users before storing it and later using it in a SQL query, allowing a Contributor to inject SQL that runs against the database once the resulting content is published and viewed b...

CVE-2026-94298 BuildKit < 1.0.29 - Contributor+ Stored SQLi via list_content Parameter

The BuildKit WordPress plugin before 1.0.29 does not properly sanitise and escape data submitted by contributor-level users before storing it and later using it in a SQL query, allowing a Contributor to inject SQL that runs against the database once the resulting content is published and viewed b...

CVE-2026-94298

The BuildKit WordPress plugin versions prior to 1.0.29 is vulnerable to a Stored SQL Injection flaw. The root cause is the improper sanitization and escaping of data submitted by contributor-level users before it is stored and subsequently used in a SQL query via the list_content parameter. This ...

PT-2026-104270

YesWiki before 4.6.7 contains a blind SQL injection vulnerability in the newtextsearch action because Bazar list option ids are concatenated into SQL REGEXP/LIKE clauses in actions/newtextsearch.php without escaping. Anonymous attackers can plant a malicious option id in an anonymously editable...

CVE-2014-125130: Improper Limitation of a Pathname to a Restricted Directory

CodeArt Google MP3 Audio Player plugin google-mp3-audio-player for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to retrieve sensitive files by supplying a path-traversal payload in the file parameter of directdownload.php...

PT-2026-104416

Name of the Vulnerable Software and Affected Versions CodeArt Google MP3 Audio Player plugin google-mp3-audio-player versions prior to 1.0.12 Description An unauthenticated arbitrary file read issue exists where remote attackers can retrieve sensitive files. This is achieved by supplying a...