CVE-2026-84859

ScadaLTS 2.8.1-release-candidate build 0 is affected by an authenticated blind SQL injection in the /api/events/search endpoint. The sortBy array values in the JSON request body are concatenated directly into the SQL ORDER BY clause without sanitization or parameterization, enabling time-based an...

EUVD-2026-80826

ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Blind SQL Injection The /api/events/search endpoint accepts a JSON body containing a sortBy array. The values in this array are concatenated directly into the SQL ORDER BY clause without any sanitization or parameterization...

CVE-2026-84859 Scada-LTS Authenticated Blind SQL Injection

ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Blind SQL Injection The /api/events/search endpoint accepts a JSON body containing a sortBy array. The values in this array are concatenated directly into the SQL ORDER BY clause without any sanitization or parameterization...

CVE-2026-92465

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Themeum WP Mega Menu allows Blind SQL Injection. This issue affects WP Mega Menu: from n/a through 1.4.2...

CVE-2026-92465 WordPress WP Mega Menu plugin <= 1.4.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Themeum WP Mega Menu allows Blind SQL Injection. This issue affects WP Mega Menu: from n/a through 1.4.2...

CVE-2026-92465

Themeum WP Mega Menu (WordPress plugin) is vulnerable to Blind SQL Injection through improper neutralization of special elements in SQL commands. The issue affects versions up to and including 1.4.2 . The vulnerability is rated CVSS 3.1 7.6 (HIGH) with a vector of AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/...

CVE-2026-92465 WordPress WP Mega Menu plugin <= 1.4.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Themeum WP Mega Menu allows Blind SQL Injection. This issue affects WP Mega Menu: from n/a through 1.4.2...

EUVD-2026-80675

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Themeum WP Mega Menu allows Blind SQL Injection. This issue affects WP Mega Menu: from n/a through 1.4.2...

CVE-2026-16588

The WP Directory Kit plugin for WordPress is vulnerable to blind SQL Injection via the 'orderby' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

EUVD-2026-80095

The WP Directory Kit plugin for WordPress is vulnerable to blind SQL Injection via the 'orderby' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

CVE-2026-16588: Improper Neutralization of Special Elements used in an SQL Command

The WP Directory Kit plugin for WordPress is vulnerable to blind SQL Injection via the 'orderby' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

CVE-2026-92465: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Themeum WP Mega Menu allows Blind SQL Injection. This issue affects WP Mega Menu: from n/a through 1.4.2...

PT-2026-93269

Name of the Vulnerable Software and Affected Versions WP Directory Kit versions prior to 1.5.5 Description The plugin is susceptible to blind SQL Injection, a technique that allows an attacker to infer data from a database by observing the application's response to specific queries. The issue...

CVE-2026-84859: Improper Neutralization of Special Elements used in an SQL Command

ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Blind SQL Injection The /api/events/search endpoint accepts a JSON body containing a sortBy array. The values in this array are concatenated directly into the SQL ORDER BY clause without any sanitization or parameterization...

CVE-2026-81567

Joomla Extension - j2commerce.com - Unauthenticated blind SQL injection in the storefront product list in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Unauthenticated, blind extraction of arbitrary database content e.g. customer records, order data, stored credentials/tokens via boolean- or...

CVE-2026-81567

J2Store (a Joomla extension by j2commerce.com) is affected by an unauthenticated blind SQL injection in the storefront product list. The flaw is reachable on any public storefront that exposes the standard product listing or product-tags filter, allowing an attacker to extract arbitrary database ...

EUVD-2026-79288

Joomla Extension - j2commerce.com - Unauthenticated blind SQL injection in the storefront product list in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Unauthenticated, blind extraction of arbitrary database content e.g. customer records, order data, stored credentials/tokens via boolean- or...

CVE-2026-81567 Joomla Extension - j2commerce.com - Unauthenticated blind SQL injection in the storefront product list in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7

Joomla Extension - j2commerce.com - Unauthenticated blind SQL injection in the storefront product list in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Unauthenticated, blind extraction of arbitrary database content e.g. customer records, order data, stored credentials/tokens via boolean- or...

CVE-2026-81567 Joomla Extension - j2commerce.com - Unauthenticated blind SQL injection in the storefront product list in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7

Joomla Extension - j2commerce.com - Unauthenticated blind SQL injection in the storefront product list in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Unauthenticated, blind extraction of arbitrary database content e.g. customer records, order data, stored credentials/tokens via boolean- or...

CVE-2026-81895 Concrete CMS 9.5.2 and below is vulnerable to Stored SQL Injection in Concrete CMS Document Library Block via `fsID[]` in `setMode=any`

In Concrete CMS before 9.5.3, the Document Library block stored the file-set identifiers submitted through fsID without validating them as integers, and when the block was configured with setMode set to any it concatenated each stored identifier directly into the file-set filter query instead of...