Lucene search
+L

219069 matches found

Cvelist
Cvelist
added 2026/08/05 5:27 a.m.42 views

CVE-2026-15941 Relevanssi <= 4.27.1 and Relevanssi Premium <= 2.30.2 - Authenticated (Contributor+) SQL Injection

The plugin provides an Admin Search page that allows users with the editposts capability to run Relevanssi searches from the WordPress dashboard. The AJAX handler accepts a URL-encoded args parameter, parses it into a WPQuery, and then passes user-controlled taxonomy query data into Relevanssi's...

6.5CVSS0.00249EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2026/08/05 5:27 a.m.13 views

CVE-2026-15941

The plugin provides an Admin Search page that allows users with the editposts capability to run Relevanssi searches from the WordPress dashboard. The AJAX handler accepts a URL-encoded args parameter, parses it into a WPQuery, and then passes user-controlled taxonomy query data into Relevanssi's...

6.5CVSS5.8AI score0.00249EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/08/05 4:25 a.m.32 views

CVE-2026-11421 ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support <= 1.17.4 - Authenticated (Custom+) SQL Injection via 'erpadvancefilter' Parameter

The ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support plugin for WordPress is vulnerable to SQL Injection via the 'erpadvancefilter' parameter in all versions up to, and including, 1.17.4 due to insufficient escaping on the user supplied parameter and lack of sufficient...

6.5CVSS0.00328EPSS
SaveExploits0References7
CVE
CVE
added 2026/08/05 4:25 a.m.43 views

CVE-2026-11421

CVE-2026-11421 affects the ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support WordPress plugin. All versions up to 1.17.4 are vulnerable to authenticated SQL Injection via the erpadvancefilter parameter due to insufficient escaping and direct interpolation into a single-quoted ...

6.5CVSS6AI score0.00328EPSS
SaveExploits0References7
EUVD
EUVD
added 2026/08/05 4:25 a.m.6 views

EUVD-2026-53041

The ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support plugin for WordPress is vulnerable to SQL Injection via the 'erpadvancefilter' parameter in all versions up to, and including, 1.17.4 due to insufficient escaping on the user supplied parameter and lack of sufficient...

6.5CVSS6AI score0.00328EPSS
SaveExploits0References7
Cvelist
Cvelist
added 2026/08/05 4:25 a.m.35 views

CVE-2026-15918 VikAppointments – Services Booking Calendar <= 1.2.19 - Unauthenticated SQL Injection

VikAppointments Service Booking Calendar wordpress plugin is vulnerable to unauthenticated SQL injection due to one of the parameters that controls how the public reviews list is sorted is taken from the incoming request and used to build a database query without proper validation or sanitization...

7.5CVSS0.00388EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/08/05 4:25 a.m.9 views

EUVD-2026-53038

VikAppointments Service Booking Calendar wordpress plugin is vulnerable to unauthenticated SQL injection due to one of the parameters that controls how the public reviews list is sorted is taken from the incoming request and used to build a database query without proper validation or sanitization...

7.5CVSS5.8AI score0.00388EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/08/05 1:45 a.m.37 views

CVE-2026-18896 lavkush-maurya Student-Registration-System changepass.php sql injection

A vulnerability was determined in lavkush-maurya Student-Registration-System 1.0. The affected element is an unknown function of the file /student/changepass.php. Executing a manipulation of the argument oldpass can lead to sql injection. It is possible to launch the attack remotely. The exploit...

6.5CVSS0.00192EPSS
SaveExploits0References5
NVD
NVD
added 2026/08/05 1:16 a.m.7 views

CVE-2026-18859

A vulnerability was identified in ESAFENET CDG up to 20260615. Affected is an unknown function of the file /CDGServer3/ukey/usbkey;logindojojs. Such manipulation of the argument keyid leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be...

7.5CVSS0.00254EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/08/05 12:45 a.m.44 views

CVE-2026-18859 ESAFENET CDG usbkey;logindojojs sql injection

A vulnerability was identified in ESAFENET CDG up to 20260615. Affected is an unknown function of the file /CDGServer3/ukey/usbkey;logindojojs. Such manipulation of the argument keyid leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be...

7.5CVSS0.00254EPSS
SaveExploits0References5
CVE
CVE
added 2026/08/05 12:45 a.m.46 views

CVE-2026-18859

CVE-2026-18859 affects ESAFENET CDG (up to 20260615). The vulnerability is tied to an unknown function in the file /CDGServer3/ukey/usbkey;logindojojs, where manipulation of the argument keyid leads to SQL injection. Attacks may be performed remotely, and a public exploit is reported as available...

7.5CVSS6.9AI score0.00254EPSS
SaveExploits0References5
NVD
NVD
added 2026/08/05 12:16 a.m.7 views

CVE-2026-18854

A vulnerability has been found in Shandong Hoteam PDM Product Data Management System up to 8.3.10. The impacted element is the function GetStoredClassByFilter of the file /Base/BaseService.asmx/DataService. The manipulation of the argument FilterString leads to sql injection. Remote exploitation ...

7.5CVSS0.00254EPSS
SaveExploits0References5
GithubExploit
GithubExploit
added 2026/08/05 12:11 a.m.23 views

Exploit for SQL Injection in Wordpress

CVE-2026-60137 — WordPress Core SQL Injection PoC Non-destruc...

9.1CVSS5.9AI score0.731EPSS
SaveExploits54
Cvelist
Cvelist
added 2026/08/05 12:0 a.m.35 views

CVE-2026-18854 Shandong Hoteam PDM Product Data Management System DataService GetStoredClassByFilter sql injection

A vulnerability has been found in Shandong Hoteam PDM Product Data Management System up to 8.3.10. The impacted element is the function GetStoredClassByFilter of the file /Base/BaseService.asmx/DataService. The manipulation of the argument FilterString leads to sql injection. Remote exploitation ...

7.5CVSS0.00254EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/08/05 12:0 a.m.9 views

EUVD-2026-53011

A vulnerability has been found in Shandong Hoteam PDM Product Data Management System up to 8.3.10. The impacted element is the function GetStoredClassByFilter of the file /Base/BaseService.asmx/DataService. The manipulation of the argument FilterString leads to sql injection. Remote exploitation ...

7.5CVSS6.8AI score0.00254EPSS
SaveExploits0References5
Packet Storm
Packet Storm
added 2026/08/05 12:0 a.m.25 views

📄 FineAdmin.Mvc SQL Injection

A proof of concept exploit for a SQL injection vulnerability in FineAdmin.Mvc. Insufficient validation of the field and order parameters allows arbitrary SQL expressions to be injected into the ORDER BY clause, enabling error-based and time-based SQL injection against affected endpoints...

9.8CVSS5.8AI score0.00685EPSS
SaveExploits1
CVE
CVE
added 2026/08/04 6:47 p.m.41 views

CVE-2026-69704

CVE-2026-69704 affects Atals-Livre and describes a SQL injection vulnerability in the supp() deletion helper function where unsanitized input passed via a GET parameter is used to manipulate database queries. The vulnerability enables attackers to craft input to perform unauthorized database oper...

7CVSS5.7AI score0.00276EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/08/04 6:47 p.m.8 views

EUVD-2026-52868

Atals-Livre contains a SQL injection vulnerability that allows attackers to manipulate database queries by passing unsanitized input through a GET parameter to the supp deletion helper function. Attackers can inject malicious SQL syntax via the vulnerable GET parameter to perform unauthorized...

7CVSS5.7AI score0.00276EPSS
SaveExploits0References3
RedHat Linux
RedHat Linux
added 2026/08/04 4:47 p.m.5 views

postgresql: PostgreSQL: Arbitrary code execution vulnerability in 'refint' module

A flaw was found in PostgreSQL. A stack buffer overflow in the 'refint' module allows an unprivileged database user to execute arbitrary code as the operating system user running the database. Additionally, a separate vulnerability exists where, if an application uses a user-controlled column as ...

8.8CVSS8.5AI score0.00378EPSS
SaveExploits0References5
Patchstack
Patchstack
added 2026/08/04 4:34 p.m.5 views

WordPress Relevanssi Premium – A Better Search plugin <= 2.30.2 - Authenticated (Contributor+) SQL Injection vulnerability

Authenticated Contributor+ SQL Injection vulnerability discovered by daroo in WordPress Plugin Relevanssi Premium versions = 2.30.2...

6.5CVSS5.8AI score0.00249EPSS
SaveExploits0References1Affected Software1
Rows per page
Query Builder