CVE-2026-18198 SQL Injection in TAC Information's GoldenHorn

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in TAC Information Services Internal and External Trade Inc. GOLDENHORN ONEIT allows Blind SQL Injection. This issue affects GOLDENHORN ONEIT: before Göbeklitepe...

CVE-2026-57777

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Automattic WooCommerce allows Blind SQL Injection. This issue affects WooCommerce: from n/a before 11.0...

EUVD-2026-70971

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Automattic WooCommerce allows Blind SQL Injection. This issue affects WooCommerce: from n/a before 11.0...

CVE-2026-57777 WordPress WooCommerce plugin < 11.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Automattic WooCommerce allows Blind SQL Injection. This issue affects WooCommerce: from n/a before 11.0...

CVE-2026-57777

Automattic WooCommerce (WordPress plugin) versions prior to 11.0 are affected by a Blind SQL Injection vulnerability in the plugin's handling of special elements in SQL commands. The vulnerability is rated CVSS 3.1: 7.6 (HIGH) , with an attack vector of network , low complexity , and high privile...

CVE-2026-57777 WordPress WooCommerce plugin < 11.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Automattic WooCommerce allows Blind SQL Injection. This issue affects WooCommerce: from n/a before 11.0...

Divi < 4.27.7 - Authenticated (Contributor+) Server-Side Request Forgery via 'image_src' Parameter

Description The Divi theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.27.6. This is due to the etpbsetvideooembedthumbnailresolution function using wpremoteget instead of wpsaferemoteget to fetch a remote image URL, which does not restrict...

Flextype CMS 1.0.0-alpha.3 Server-Side Request Forgery

lextype CMS version 1.0.0-alpha.3 contains a server-side request forgery SSRF vulnerability in the expression-processing functionality exposed through the /api/v1/query endpoint. An authenticated remote attacker can supply an arbitrary URL to the exposed fetch function, causing the Flextype serve...

CVE-2026-85388

Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowing authenticated users to inject arbitrary PostgreSQL expressions into ORDER BY clauses. Attackers can use time-based and boolean-based blind SQL injection techniques to extract...

CVE-2026-85388 Worklenz through 3.0.0 SQL Injection via the sort-field Query Parameter

Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowing authenticated users to inject arbitrary PostgreSQL expressions into ORDER BY clauses. Attackers can use time-based and boolean-based blind SQL injection techniques to extract...

CVE-2026-85388 Worklenz through 3.0.0 SQL Injection via the sort-field Query Parameter

Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowing authenticated users to inject arbitrary PostgreSQL expressions into ORDER BY clauses. Attackers can use time-based and boolean-based blind SQL injection techniques to extract...

CVE-2026-85388

Worklenz through 3.0.0 is vulnerable to blind SQL injection via the sort-field query parameter in pagination helper functions. The root cause is improper validation that allows authenticated users to inject arbitrary PostgreSQL expressions into ORDER BY clauses. Attackers can leverage time-based ...

ServiceNow Platform Unauthenticated Blind SQL Injection (CVE-2024-8924)

ServiceNow has addressed a blind SQL injection vulnerability that was identified in the Xanadu, Washington DC, and earlier Now Platform releases. This vulnerability could potentially enable an unauthenticated user to acquire unauthorized data stored within the Now Platform. Note that Nessus has n...

CVE-2026-76006

Photo Gallery by Ays (WordPress plugin) versions up to and including 6.8.2 are vulnerable to SQL Injection via the 's' parameter . The root cause is insufficient escaping and lack of query preparation on user-supplied input across two execution paths: $wpdb-&gt;get_var() in record_count() and $wp...

EasyAppointments 1.5.1 - Blind SQL Injection

Exploit Title: EasyAppointments 1.5.1 - Blind SQL Injection Google Dork: N/A backend login required Date: 07/27/2026 Exploit Author: Michael Chesang Vendor Homepage: https://easyappointments.org Software Link: https://github.com/alextselegidis/easyappointments/releases Version: = 1.5.1 REQUIRED...

EasyAppointments 1.5.1 Blind SQL Injection

A blind SQL injection vulnerability exists in the orderby parameter of the /index.php/customers/search endpoint in EasyAppointments versions 1.5.1 and below. The parameter is passed unsanitized to CodeIgniter 3 Query Builder orderby. Parenthesized subqueries bypass backtick escaping via CI3's...

CVE-2026-81889

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can bypass server-side request forgery protections when PHP cURL is unavailable because validateaddress validates $info'ip', but getremotecontent...

elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback

poc.zip Summary elFinder 2.1.69 is vulnerable to a Server-Side Request Forgery SSRF protection bypass when PHP cURL is unavailable and URL uploads use the fsockgetcontents fallback. An attacker who can submit a URL for server-side upload can use an attacker-controlled DNS hostname that initially...

CVE-2026-81889 elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can bypass server-side request forgery protections when PHP cURL is unavailable because validateaddress validates $info'ip', but getremotecontent...

CVE-2026-82655

Admidio before 5.0.12 contains a blind SQL injection vulnerability in the relationtypelist parameter of listsshow.php that allows unauthenticated attackers to execute arbitrary SQL queries. Attackers can bypass authentication by providing a dummy UUID in rolelist and inject SQL through...