CVE-2026-87747

Ragic Enterprise Cloud Database is affected by an Arbitrary File Read vulnerability caused by Relative Path Traversal . Privileged remote attackers can exploit this flaw to download arbitrary system files, resulting in high confidentiality impact with no integrity or availability impact. The CVSS...

CVE-2026-87747 Ragic｜Enterprise Cloud Database - Arbitrary File Read

The Enterprise Cloud Database developed by Ragic has an Arbitrary File Read vulnerability. Privileged remote attackers can exploit Relative Path Traversal to download arbitrary system files...

EUVD-2026-74725

The Enterprise Cloud Database developed by Ragic has an Arbitrary File Read vulnerability. Privileged remote attackers can exploit Relative Path Traversal to download arbitrary system files...

CVE-2026-14962

The ELEX WooCommerce Request a Quote WordPress plugin before 2.4.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks and extract arbitrary data from the database...

CVE-2026-87034

Tanium addressed a SQL injection vulnerability in Comply...

SUSE CVE-2026-55678

Arc is an open, SQL-native time-series database for telemetry. From 26.02.1 until 26.06.2, Arc Enterprise clustering accepts cluster join requests without authentication when cluster.enabled is true but cluster.sharedsecret is not configured. The defaults in internal/config/config.go set...

PT-2026-89018

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0 Description An issue exists where the application fails to verify the return value of storage write operations within the ImageUploadRequest::handleImages function. Due to the default disk mode of the Laravel...

PT-2026-88871

The Quentn WP WordPress plugin before 1.2.15 does not adequately escape a request parameter before using it in an unprepared SQL query, allowing unauthenticated attackers to extract arbitrary data from the database via SQL injection...

CVE-2026-13359: Improper Neutralization of Input During Web Page Generation

The Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cntctfrmcontactdropdown Parameter in all versions up to, and including, 1.7.5 due to insufficient input sanitization and output escaping. This makes...

An Empirical Analysis of ReDoS Vulnerabilities and ReDoS Detection Tools

ReDoS vulnerabilities are a type of denial of service software weakness that occurs when a regex is used to validate user-supplied input. In some cases, the regex matching process can take exponential time, leading to a denial of service. In this study, we examine and compare the effectiveness of...

PT-2026-88857

The ELEX WooCommerce Request a Quote WordPress plugin before 2.4.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks and extract arbitrary data from the database...

EUVD-2026-75136

SQL injection in the RelatedProduct block in Mageplaza Blog for Magento 2 mageplaza/magento-2-blog-extension through 4.3.2 allows remote unauthenticated attackers to execute arbitrary SQL commands and read arbitrary database contents via the id parameter to /mpblog/post/view...

CVE-2026-79322: Improper Neutralization of Special Elements used in an SQL Command

SQL injection in the RelatedProduct block in Mageplaza Blog for Magento 2 mageplaza/magento-2-blog-extension through 4.3.2 allows remote unauthenticated attackers to execute arbitrary SQL commands and read arbitrary database contents via the id parameter to /mpblog/post/view...

CVE-2026-87747: Relative Path Traversal

The Enterprise Cloud Database developed by Ragic has an Arbitrary File Read vulnerability. Privileged remote attackers can exploit Relative Path Traversal to download arbitrary system files...

CVE-2026-14962: Improper Neutralization of Special Elements used in an SQL Command

The ELEX WooCommerce Request a Quote WordPress plugin before 2.4.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks and extract arbitrary data from the database...

CVE-2026-19800: Improper Neutralization of Special Elements used in an SQL Command

The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to SQL Injection via the 'status' parameter in all versions up to, and including, 1.31.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-19778: Improper Neutralization of Special Elements used in an SQL Command

The WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping plugin for WordPress is vulnerable to time-based SQL Injection via the 'feed' parameter in all versions up to, and including, 2.23.7 due to insufficient escaping on the user supplied parameter and lack of...

PT-2026-88882

The Enterprise Cloud Database developed by Ragic has an Arbitrary File Read vulnerability. Privileged remote attackers can exploit Relative Path Traversal to download arbitrary system files...

PT-2026-89238

The CSP Log module enhances any module that adds the CSP header to a site, by providing a reporting endpoint, custom storage, and aggregated reports that can be used to trace issues or adapt the CSP headers. The module did not sufficiently sanitize user-supplied values used in database queries,...

CSP log - Critical - SQL Injection - SA-CONTRIB-2026-136

The CSP Log module enhances any module that adds the CSP header to a site, by providing a reporting endpoint, custom storage, and aggregated reports that can be used to trace issues or adapt the CSP headers. The module did not sufficiently sanitize user-supplied values used in database queries,...