Expression Language (SpEL) Injection

Spring Data MongoDB is vulnerable to Expression Language SpEL Injection. The vulnerability is due to improper handling of user-supplied values during parameter binding in @Query repository methods using a capture-all placeholder, which allows an attacker to inject and execute malicious SpEL...

CVE-2026-12743

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-12743 affiliate-toolkit <= 3.8.8 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-12743

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-12743

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient...

EUVD-2026-58590

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-12743 affiliate-toolkit <= 3.8.8 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-19764

A vulnerability was identified in Raisecom Communication Command and Dispatch Management Platform up to 7.6.5. This affects an unknown part of the file /app/users/getpwd.php. Such manipulation of the argument sip leads to sql injection. The attack can be executed remotely. The exploit is publicly...

CVE-2026-19767

A weakness has been identified in itsourcecode Hospital Management System 1.0. This issue affects some unknown processing of the file viewdoctortimings.php. Executing a manipulation of the argument delid can lead to sql injection. The attack may be performed from remote. The exploit has been made...

CVE-2026-19767 itsourcecode Hospital Management System viewdoctortimings.php sql injection

A weakness has been identified in itsourcecode Hospital Management System 1.0. This issue affects some unknown processing of the file viewdoctortimings.php. Executing a manipulation of the argument delid can lead to sql injection. The attack may be performed from remote. The exploit has been made...

CVE-2026-19767 itsourcecode Hospital Management System viewdoctortimings.php sql injection

A weakness has been identified in itsourcecode Hospital Management System 1.0. This issue affects some unknown processing of the file viewdoctortimings.php. Executing a manipulation of the argument delid can lead to sql injection. The attack may be performed from remote. The exploit has been made...

EUVD-2026-58562

A weakness has been identified in itsourcecode Hospital Management System 1.0. This issue affects some unknown processing of the file viewdoctortimings.php. Executing a manipulation of the argument delid can lead to sql injection. The attack may be performed from remote. The exploit has been made...

CVE-2026-19767

CVE-2026-19767 affects itsourcecode Hospital Management System 1.0. A SQL injection is possible via viewdoctortimings.php by manipulating the delid parameter. Exploitation can be performed remotely, and a public exploit is available. The provided docs do not specify a patch or remediation.

SUSE CVE-2026-68185

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Move jumplabelinit before parseearlyparam When enabling both CONFIGMEMALLOCPROFILING=y and CONFIGMEMALLOCPROFILINGENABLEDBYDEFAULT=y, then diabling memory profiling by adding the boot parameter 'sysctl.vm.memprofiling=...

CVE-2026-19764

CVE-2026-19764 affects Raisecom’s Command and Dispatch Management Platform up to version 7.6.5. The vulnerability is in an unknown part of /app/users/getpwd.php where manipulating the sip argument causes SQL injection. The issue is exploitable remotely and public exploit code exists. References d...

EUVD-2026-58545

A flaw has been found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. The affected element is the function axios.get of the file src/index.ts of the component parse-csv tool. This manipulation of the argument csvUrl causes server-side request forgery. The attack...

PT-2026-72041

Name of the Vulnerable Software and Affected Versions Webkul Bagisto versions prior to 2.4.5 Description An authorization bypass exists in the Backend Customer Detail Feature within the /admin/customers/view endpoint. A remote attacker can exploit this by manipulating the ID argument, allowing...

PT-2026-71938

A vulnerability was identified in Raisecom Communication Command and Dispatch Management Platform up to 7.6.5. This affects an unknown part of the file /app/users/getpwd.php. Such manipulation of the argument sip leads to sql injection. The attack can be executed remotely. The exploit is publicly...

PT-2026-71962

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient...

PT-2026-72154

Name of the Vulnerable Software and Affected Versions Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms versions prior to 5.2 Description This issue is a generic SQL Injection, which occurs when an application fails to properly sanitize user input, allowing an attacker to...