CVE-2026-53574

The open-source customer relationship management application EspoCRM is vulnerable to a boolean-based blind SQL injection in versions 8.1.0 through 9.3.8 . The flaw exists in the GET entity streamAttachments endpoint because the query path permits complex expressions, allowing an authenticated no...

CVE-2026-53574 EspoCRM: Blind SQL injection via streamAttachments where-clause complex expression

EspoCRM is an open source customer relationship management application. From 8.1.0 until 9.3.8, an authenticated non-administrator can submit a crafted where parameter to the GET entity streamAttachments endpoint because that query path permits complex expressions. Boolean-based blind SQL injecti...

CVE-2026-109688

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7...

EUVD-2026-102048

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7...

CVE-2026-109688 WordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7...

CVE-2026-109688

The Link Whisper Free WordPress plugin (versions

CVE-2026-109688: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7...

CVE-2026-105067

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Webnus Modern Events Calendar Lite modern-events-calendar-lite allows Blind SQL Injection.This issue affects Modern Events Calendar Lite: from n/a before 7.37.0...

EUVD-2026-100988

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Webnus Modern Events Calendar Lite modern-events-calendar-lite allows Blind SQL Injection.This issue affects Modern Events Calendar Lite: from n/a before 7.37.0...

CVE-2026-105067 WordPress Modern Events Calendar Lite plugin < 7.37.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Webnus Modern Events Calendar Lite modern-events-calendar-lite allows Blind SQL Injection.This issue affects Modern Events Calendar Lite: from n/a before 7.37.0...

CVE-2026-105067

The Modern Events Calendar Lite WordPress plugin (versions before 7.37.0 ) is vulnerable to a Blind SQL Injection flaw. This issue stems from the improper neutralization of special elements used in SQL commands. The vulnerability allows an attacker with low-level privileges to potentially impact ...

CVE-2026-95808

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via the 'inputs' parameter in all versions up to, and including, 1.15.48 due to insufficient escaping on the user supplied parameter and lack of sufficient...

EUVD-2026-100797

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via the 'inputs' parameter in all versions up to, and including, 1.15.48 due to insufficient escaping on the user supplied parameter and lack of sufficient...

PT-2026-113624

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via the 'inputs' parameter in all versions up to, and including, 1.15.48 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-105067: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Webnus Modern Events Calendar Lite modern-events-calendar-lite allows Blind SQL Injection.This issue affects Modern Events Calendar Lite: from n/a before 7.37.0...

CVE-2026-95808: Improper Neutralization of Special Elements used in an SQL Command

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via the 'inputs' parameter in all versions up to, and including, 1.15.48 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-109687

The Link Whisper Free WordPress plugin (versions ¢= 0.9.7 ) is vulnerable to Blind SQL Injection due to the Improper Neutralization of Special Elements used in an SQL Command . An attacker with high privileges may leverage this flaw to execute unauthorized database queries. No specific remediatio...

CVE-2026-108179

The PluginUs.Net WOLF bulk-editor for WordPress, versions up to and including 1.1.1 , is susceptible to a Blind SQL Injection vulnerability. This issue stems from the Improper Neutralization of Special Elements used in an SQL command. An attacker with high privileges could potentially exploit thi...

CVE-2026-108179: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in PluginUs.Net WOLF bulk-editor allows Blind SQL Injection.This issue affects WOLF: from n/a through 1.1.1...

VulnCheck KEV: CVE-2026-49772

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Liquid Web / StellarWP The Events Calendar allows Blind SQL Injection. This issue affects The Events Calendar: from 6.15.12 through 6.16.2...