4243 matches found
WordPress Core 6.9-7.0.1 - Pre-Auth Batch-Route Confusion
WordPress core versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are vulnerable to a pre-authentication route confusion issue in the REST API batch endpoint /?restroute=/batch/v1. A malformed nested batch request desynchronizes the batch router, allowing unauthenticated requests to reach...
Doctor Appointment System 1.0 - SQL Injection
Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malicious SQL queries via firstname parameter. id: CVE-2021-27320 info: name: Doctor Appointment System 1.0 - SQL Injection author: theamanrawat severity: high description: | Blind S...
Jms Blog - SQL Injection
The module Jms Blog jmsblog from Joommasters contains a Time Based SQL injection vulnerability. This module is for the PrestaShop e-commerce platform and mainly provided with joommasters PrestaShop themes id: CVE-2023-27034 info: name: Jms Blog - SQL Injection author: MaStErChO severity: critical...
CVE-2026-15403
The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to blind SQL Injection via the 'field' parameter in all versions up to, and including, 2.9.9.6.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Thi...
CVE-2026-33385
A Blind SQL injection vulnerability has been identified in Quick.CMS. Improper neutralization of input provided by a high-privileged user into multiple fields in administration panel allows for Blind SQL Injection attacks. The vendor states that this administration panel already allows for...
CVE-2026-33385 Blind SQL Injection in Quick.CMS
A Blind SQL injection vulnerability has been identified in Quick.CMS. Improper neutralization of input provided by a high-privileged user into multiple fields in administration panel allows for Blind SQL Injection attacks. The vendor states that this administration panel already allows for...
EUVD-2026-50310
A Blind SQL injection vulnerability has been identified in Quick.CMS. Improper neutralization of input provided by a high-privileged user into multiple fields in administration panel allows for Blind SQL Injection attacks. The vendor states that this administration panel already allows for...
CVE-2026-63229
A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to use a time-based SQL oracle via the SSO OAuth endpoint to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable...
CVE-2026-63229 Pre-authentication blind SQL injection vulnerability
A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to use a time-based SQL oracle via the SSO OAuth endpoint to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable...
EUVD-2026-50124
A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to use a time-based SQL oracle via the SSO OAuth endpoint to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable...
CVE-2026-6251
Chaty Pro for WordPress (≤ version 3.5.5) is affected by an authenticated time-based blind SQL injection via the widget_id parameter in POST data. The vulnerability arises because fetch_custom_field() concatenates the raw POST value into a numeric SQL context without proper preparation (no $wpdb-...
security-advisories
Threat Lance Security Advisories Public security advisory rep...
📄 WordPress Community Events 1.5.1 Unauthenticated Blind SQL Injection
WordPress Community Events plugin version 1.5.1 contains an unauthenticated time-based blind SQL injection vulnerability. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit demonstrates the vulnerabl...
📄 WordPress Contact Forms by CRM Perks 1.0.7 Unauthenticated Blind SQL Injection
WordPress Contact Forms by CRM Perks plugin version 1.0.7 contains an unauthenticated time-based blind SQL injection vulnerability. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit demonstrates the...
📄 WordPress WP Extended 3.0.12 Unauthenticated Blind SQL Injection
WordPress WP Extended plugin version 3.0.12 contains an unauthenticated time-based blind SQL injection vulnerability through X-Forwarded-For. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit...
CVE-2026-57309
CVE-2026-57309 involves a Blind SQL injection in Windu CMS. The vulnerability allows a remote, unauthenticated attacker to inject SQL syntax into the URL path in the HTTP header, leading to Blind SQL Injection. It has been confirmed in version 4.1 and may affect other versions. The report cites a...
EUVD-2026-45943
A Blind SQL injection vulnerability has been identified in Windu CMS. A remote unauthenticated attacker is able to inject SQL syntax into URL path in HTTP header resulting in Blind SQL Injection. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in versi...
CVE-2026-57309
A Blind SQL injection vulnerability has been identified in Windu CMS. A remote unauthenticated attacker is able to inject SQL syntax into URL path in HTTP header resulting in Blind SQL Injection. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in versi...