94712 matches found
CVE-2026-87767: Improper Neutralization of Special Elements used in an SQL Command
The wp shortcut link and advertisement baner WordPress plugin through 1.2.0 does not sanitize and escape a parameter before using it in a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data...
CVE-2026-63445: Improper Limitation of a Pathname to a Restricted Directory
Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the request-controlled project query parameter into the resource Query structure without validating it against directory traversal...
CVE-2026-18442: Improper Neutralization of Special Elements used in an SQL Command
The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wcfmmpuserlocationlng' parameter in all versions up to, and including, 3.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient...
CVE-2026-17619: Improper Neutralization of Special Elements used in an SQL Command
IBM Platform RTM is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database...
PT-2026-95617
Name of the Vulnerable Software and Affected Versions IBM Platform RTM affected versions not specified Description An issue exists where a remote attacker can execute specially crafted SQL statements. This allows the attacker to view, add, modify, or delete information within the back-end databas...
PT-2026-101413
Security vulnerability affects the litellm-database package. This issue is resolved in later releases. See references for vulnerability details...
PT-2026-101331
Security vulnerability affects the litellm-database package. This issue is resolved in later releases. See references for vulnerability details...
PT-2026-101564
Security vulnerability affects the litellm-database package. This issue is resolved in later releases. See references for vulnerability details...
PT-2026-101676
Security vulnerability affects the litellm-database package. This issue is resolved in later releases. See references for vulnerability details...
PT-2026-100911
Security vulnerability affects the litellm-database package. This issue is resolved in later releases. See references for vulnerability details...
PT-2026-95242
Name of the Vulnerable Software and Affected Versions wp shortcut link and advertisement baner WordPress plugin versions prior to 1.2.1 Description An issue exists where a parameter is not sanitized or escaped before being used in a SQL query within an AJAX action accessible to unauthenticated...
PT-2026-95245
Name of the Vulnerable Software and Affected Versions Tz Weekly Radio Schedule versions prior to 1.8.2 Description The plugin fails to sanitize and escape the week parameter before incorporating it into a SQL query within an AJAX action. This flaw allows unauthenticated attackers to execute SQL...
PT-2026-95244
Name of the Vulnerable Software and Affected Versions Product Question and Answer versions prior to 1.1.1 Description The Product Question and Answer WordPress plugin fails to sanitize and escape parameters used in SQL queries during AJAX actions accessible to unauthenticated users. This allows a...
PT-2026-95291
Name of the Vulnerable Software and Affected Versions WCFM Marketplace versions prior to 3.8.2 Description The WCFM Marketplace plugin for WordPress is subject to SQL Injection, a technique where malicious SQL statements are inserted into entry fields for execution. This occurs because the...
PT-2026-95374
Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.9.1 Description An access control bypass exists in the query database tool exposed through the AI chat endpoints. The tool executes queries without binding the authenticated principal to the DatabaseContext, which...
CVE-2026-17607: Improper Neutralization of Special Elements used in an SQL Command
The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via the 'where' shortcode attribute of the wpinventory shortcode in versions up to, and including, 2.5.1. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the...
CVE-2026-87775: Improper Neutralization of Special Elements used in an SQL Command
The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the...
PT-2026-100401
Security vulnerability affects the litellm-database package. This issue is resolved in later releases. See references for vulnerability details...
CVE-2026-87774: Improper Neutralization of Special Elements used in an SQL Command
The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the...