CVE-2026-54646 CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.php

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablename values into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE statements without validating the identifiers or escaping embedded backticks. An authenticated...

CVE-2026-54646

CubeCart (an ecommerce platform) is affected by a SQL identifier injection in admin/sources/maintenance.index.inc.php (line 551) prior to 6.7.5 . Administrator-supplied table names from POST parameters are wrapped in backticks and placed into structural SQL statements (ALTER TABLE, CHECK TABLE, A...

CVE-2026-39492

CVE-2026-39492 — WP Maps Blind SQL Injection Scanner Pre-Auth Time-Based Blind SQLi via Backtick Bypass → DB Extraction Overview CVE-2026-39492 is a critical-severity CVSS 9.3 unauthenticated blind SQL injection vulnerability in the WP Maps plugin wp-google-map-plugin versions ≤ 4.9.1. The...

Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection

Summary The terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to shellexec. After the fix for GHSA-9643-6xjp-vx57 which added $ to the blocklist, the characters | single pipe, backtick, and the newline byte 0x0A remain...

PT-2026-60697

Name of the Vulnerable Software and Affected Versions Pheditor versions 2.0.1 through 2.0.5 Description The terminal feature in Pheditor contains a flaw in how it sanitizes user-supplied commands before passing them to the shell exec function. While a blocklist is used to filter dangerous...