WordPress Ninja Forms - Save Progress plugin <= 3.0.30 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Data Deletion via admin-ajax.php with admin_init Hook vulnerability

WordPress Ninja Forms - Save Progress plugin = 3.0.30 - Missing Authorization to Authenticated Subscriber+ Arbitrary Data Deletion via admin-ajax.php with admininit Hook vulnerability discovered by Hermione in WordPress Plugin Ninja Forms - Save Progress versions = 3.0.30...

PT-2026-86428

Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to store a value of arbitrary size in an attribute whose length constraint should bound it. Ash measures string length with Elixir's String.length/1, which counts Unicode graphemes, in the max...

CVE-2026-84937: Improper Neutralization of Special Elements used in an SQL Command

The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQL statement, allowing users with the Contributor role and above to perform SQL injection attacks and read arbitrary data from the database...

PT-2026-85289

Name of the Vulnerable Software and Affected Versions core-moos versions prior to 10.4.1 Description A pre-authentication heap overflow exists in MOOSCommPkt packet handling. Remote attackers can write arbitrary data by declaring a negative packet length. This is achieved by exploiting a signed...

WordPress Amelia plugin 7.0-9.6 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Mustafa Ahmed in WordPress Plugin Amelia versions 7.0-9.6...

PT-2026-78631

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the PowerVM hypervisor call interface. An attacker with root access to a guest partition can issue a specially crafted hypervisor call to...

EUVD-2026-58503

Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in identifiers. Attackers with write permission on a table with a double-quote in its name can inject SQL that executes as the datasource's...

PT-2026-71211

Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index parameters...

CVE-2026-72609

An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the acquisition = orderreceive permission to read arbitrary database contents via the orderby request parameter in acqui/parcels.pl. The parameter is passed to...

CVE-2026-72607

Koha SQL injection (CVE-2026-72607) is a stored, authenticated vulnerability affecting Koha up to 26.05.01 and earlier 24.11.17/25.05.12/25.11.06. An authenticated staff member with items_batchmod can store a payload in the agefield of an automatic modification rule; the value is written to a sys...

CVE-2026-72731

Discourse is an open-source discussion platform. From 2026.1.0-latest until 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, anyone able to run a parameterized Data Explorer query, including non-staff members of a group a query is shared with, could craft parameter values that escaped the...

PT-2026-69373

Name of the Vulnerable Software and Affected Versions Library Management System versions prior to 3.6.7 Description Insufficient sanitization and escaping of a user-supplied parameter used in a SQL statement allows users with roles as low as Subscriber to perform SQL injection. This can lead to t...

CVE-2026-19049: Improper Neutralization of Special Elements used in an SQL Command

The ProSolution WP Client WordPress plugin before 2.0.9 does not sanitise a cookie value before using it in SQL queries, and processes that cookie on every request without any authentication or capability check, allowing unauthenticated users to read arbitrary data from the database and to delete...

PT-2026-69378

Name of the Vulnerable Software and Affected Versions ProSolution WP Client versions prior to 2.0.9 Description An issue exists where a cookie value is not sanitized before being used in SQL queries. This cookie is processed on every request without authentication or capability checks, allowing...

CVE-2026-53984

Ground Station (before 0.6.0) is vulnerable to unauthenticated database wipe and arbitrary data injection via Socket.IO. The database_backup full_restore handler accepts a caller-supplied SQL blob, enabling an unauthenticated network peer to drop or recreate the SQLite database (via attacker-cont...

CVE-2026-53984 Ground Station prior to 0.6.0 Unauthenticated Database Wipe and Arbitrary Data Injection via Socket.IO database_backup full_restore Action

Ground Station prior to 0.6.0 contains an unauthenticated database-destruction and arbitrary-data-injection vulnerability in the Socket.IO server's databasebackup event handler that allows any unauthenticated network peer to wipe or replace the entire SQLite database by sending a single fullresto...

CVE-2026-53984: Missing Authentication for Critical Function

Ground Station prior to 0.6.0 contains an unauthenticated database-destruction and arbitrary-data-injection vulnerability in the Socket.IO server's databasebackup event handler that allows any unauthenticated network peer to wipe or replace the entire SQLite database by sending a single fullresto...

PT-2026-68755

Name of the Vulnerable Software and Affected Versions Ground Station versions prior to 0.6.0 Description An unauthenticated database-destruction and arbitrary-data-injection issue exists in the Socket.IO server's database backup event handler. Due to disabled authentication enforcement and a...

CVE-2026-71237: Improper Neutralization of Special Elements used in an SQL Command

Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from 'pwd' with no sanitization and concatenates it into a raw SQL string: mysqlquery"select from userlists where username='' and password='' limit 1". An unauthenticated attacker can submit a payload...

CVE-2026-58046

Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database, leading to full compromise of the panel...