94663 matches found
CVE-2026-19347 itsourcecode Hospital Management System viewdoctor.php sql injection
A vulnerability was identified in itsourcecode Hospital Management System 1.0. This issue affects some unknown processing of the file /viewdoctor.php. Such manipulation of the argument delid leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might b...
CVE-2026-19343
A flaw has been found in code-projects Task Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/AdminLogin.php. Executing a manipulation of the argument email/password can lead to sql injection. The attack may be performed from remote. The exploit...
CVE-2026-18032
The WP Data Access WordPress plugin before 5.5.79 does not validate the column names it accepts on one of its unauthenticated AJAX actions, and the nonce guarding that action does not cover them, allowing unauthenticated attackers to read arbitrary columns of the database table the affected...
CVE-2026-17017 CubeWP Framework < 1.1.31 - Subscriber+ SQL Injection via cubewp_remove_relation
The CubeWP Framework WordPress plugin before 1.1.31 does not properly sanitize and escape a parameter before using it in a SQL statement through an AJAX action, and does not include a capability check on that action, allowing users with Subscriber-level access and above to perform SQL injection...
EUVD-2026-54880
The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...
EUVD-2026-54894
The Iptanus File Upload WordPress plugin before 5.1.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by unauthenticated users...
EUVD-2026-54895
The WP Data Access WordPress plugin before 5.5.79 does not validate the column names it accepts on one of its unauthenticated AJAX actions, and the nonce guarding that action does not cover them, allowing unauthenticated attackers to read arbitrary columns of the database table the affected...
PT-2026-69284
Name of the Vulnerable Software and Affected Versions code-projects Task Management System version 1.0 Description A remote SQL injection exists in the /admin/AdminLogin.php endpoint. This issue occurs when the email and password variables are manipulated, allowing an attacker to execute...
PT-2026-69271
Name of the Vulnerable Software and Affected Versions WP Data Access versions prior to 5.5.79 Description An issue exists where the plugin fails to validate column names accepted during an unauthenticated AJAX action. Because the nonce guarding this action does not cover the column names,...
Drizzle / Prisma Schema Exposure Detection
Probes for exposed prisma/schema.prisma, migration SQL, drizzle.config.ts, drizzle/meta/journal.json, and db/schema.ts files leaking full DB schemas. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed Drizzle ORM and Prisma schema/migration artifacts.""" from kittysploit import from...
Ghostlink_lite
GHOSTLINK // Enterprise Cyber Command Center & Defensive Scann...
EUVD-2026-54738
The WP Directory Kit WordPress plugin before 1.5.5 does not sanitize and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks authorization and nonce checks, allowing any authenticated user such as a Subscriber to perform SQL injection...
Wordfence Intelligence Weekly WordPress Vulnerability Report (July 27, 2026 to August 2, 2026)
Last week, there were 300 vulnerabilities disclosed in 235 WordPress Plugins and 2 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 150 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...
Security Bulletin: IBM® Db2® could allow a local attacker to cause a denial of service due to a memory leak (CVE-2026-18096)
Summary IBM® Db2® could allow a local attacker to cause a denial of service due to a memory leak. Vulnerability Details CVEID:CVE-2026-18096 DESCRIPTION: DB2 for Linux, UNIX and Windows includes DB2 Connect Server could allow a local attacker to cause a denial of service due to a memory leak...
Security Bulletin: IBM® Db2® is vulnerable to privilege escalation with a specially crafted query (CVE-2026-10543)
Summary IBM® Db2® is vulnerable to privilege escalation with a specially crafted query. Vulnerability Details CVEID:CVE-2026-10543 DESCRIPTION: IBM Db2 is vulnerable to privilege escalation with a specially crafted query. CWE:CWE-285: Improper Authorization CVSS Source: IBM CVSS Base score: 8.2...
Security Bulletin: IBM® Db2® is affected by multiple vulnerabilities in Corosync 3.1.9 (CVE-2026-35091, CVE-2026-35092)
Summary IBM® Db2® is affected by multiple vulnerabilities in Corosync 3.1.9. Vulnerability Details CVEID:CVE-2026-35091 DESCRIPTION: A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value vulnerability in the Corosync membership commit token sanity check ...
CVE-2026-64636
An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database...
CVE-2026-47362
In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LocalNotificationDatabase notification title, message, recipient, service, tags, and on-call/incident deep links and SearchRecentDatabase the user's full in-a...
CVE-2026-47362
In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LocalNotificationDatabase notification title, message, recipient, service, tags, and on-call/incident deep links and SearchRecentDatabase the user's full in-a...