CVE-2026-88854 Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7

Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla getVar, which is not a real Joomla filter method and falls through to a filter that strips HTML tags but does not touch quotes or SQL syntax. The value is concatenated directly into a...

EUVD-2026-83767

Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla getVar, which is not a real Joomla filter method and falls through to a filter that strips HTML tags but does not touch quotes or SQL syntax. The value is concatenated directly into a...

CVE-2025-29529

SQLi ITC Multiplan CVE-2025-29529 发现 2025年2月21日，在一次客户参与中，发现ITC Systems开发的“Multiplan”平台存在SQL注入漏洞。 受影响版本 该漏洞仅在v3.7.4.1002版本上进行了测试 攻击向量 由“ForgotPassword.aspx”端点使用的“ctl00%24cpLogin%24ctlForgotPassword%24txtEmail”POST参数被发现未经过滤。未认证的攻击者可以利用此漏洞读取应用程序的后端数据库。 POC 作为概念验证（PoC），收集了数据库信息，如表和列。 漏洞检测...

CVE-2026-87963

The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthenticated attackers to perform SQL injection and read arbitrary database...

CVE-2026-76425 Cisco ISE SQL Injection Vulnerability

A vulnerability in the APIs of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks against the backend database. This vulnerability is due to insufficient validation of certain parameters that are concatenated directly into an SQL query. An attacker could...

CVE-2026-65761

CVE-2026-65761 — EasyStore Joomla 预认证SQL注入 filtersortby 方向 → ORDER BY 注入 → 完全数据库读取 概述 CVE-2026-65761 （CVSS 9.3 严重）是 JoomShaper 开发的 EasyStore for Joomla 中存在的一个无需认证的 SQL 注入 漏洞，影响版本 ≤ 2.0.1 。 产品列表参数 filtersortby 会被拆分为列名和方向两部分。虽然列名通过白名单验证，但方向被直接拼接到 SQL 的ORDER BY 子句中，未对 ASC/DESC 做任何限制——允许匿名访客执行任意 SQL...

October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls

A vulnerability was identified in the Twig sandbox security policy that allowed a chained bypass when cms.safemode is enabled. The Laravel session store was exposed to Twig with unrestricted method access, and raw SQL methods reachable through Eloquent's call forwarding were not blocked across th...

CVE-2026-89180

EFence developed by Thinking Software Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents...

CVE-2026-89180

EFence , developed by Thinking Software Technology , contains a SQL Injection vulnerability that allows unauthenticated remote attackers to inject arbitrary SQL commands and read database contents . The vulnerability requires no user interaction and can be exploited over the network with low comp...

CVE-2026-89180 Thinking Software Technology｜EFence - SQL Injection

EFence developed by Thinking Software Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents...

EUVD-2026-77360

EFence developed by Thinking Software Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents...

CVE-2026-26980

CVE-2026-26980 — 👻 Ghost CMS 存在通过 Content API 的未认证 SQL 注入漏洞 Ghost 的 Content API 中存在一个 SQL 注入漏洞，允许未认证攻击者读取数据库中的任意数据。...

CVE-2026-26980-PoC

CVE-2026-26980 — Ghost CMS 内容 API 盲 SQL 注入 受影响版本： Ghost 3.24.0 – 6.19.0 修复版本： Ghost 6.19.1 所需认证： 无——内容 API 密钥是公开的 影响： 未认证即可读取整个数据库（凭据、API 密钥） 漏洞 slug-filter-order.js 将用户提供的 slug 值直接插值到原始 SQL ORDER BY 子句中，而不是使用参数化绑定。 root@kitploit: // VULNERABLE — Ghost '$s'.join','; return CASE WHEN $table.slug I...

EUVD-2026-75136

SQL injection in the RelatedProduct block in Mageplaza Blog for Magento 2 mageplaza/magento-2-blog-extension through 4.3.2 allows remote unauthenticated attackers to execute arbitrary SQL commands and read arbitrary database contents via the id parameter to /mpblog/post/view...

CVE-2026-84221 Kirki 6.0.0 - 6.2.5 - Editor+ SQLi via Content Manager Field ID

The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append arbitrary SQL and read the contents of the database, including user credentials...

CVE-2026-52763

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the recentchanges action actions/recentchanges.php accepts a period argument from two disjoint parameter spaces. A whitelist validates only the URL form against 'day','week','month'. The action-argument form takes the else branch wi...

CVE-2026-52763

YesWiki , a PHP-based wiki system, is affected by a stored SQL injection in the recentchanges action (actions/recentchanges.php). The period argument supplied via the action syntax ({{recentchanges period="..."}}) bypasses a whitelist that only validates the $_GET form, flowing unvalidated into P...

CVE-2026-52763 YesWiki: SQL injection via the `recentchanges` action `period` argument leading to arbitrary DB read

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the recentchanges action actions/recentchanges.php accepts a period argument from two disjoint parameter spaces. A whitelist validates only the URL form against 'day','week','month'. The action-argument form takes the else branch wi...

CVE-2026-82871

ToolJet before v3.16.208 fails to validate organization membership in database read routes, allowing any authenticated user to access other organizations' table schemas and row data. Attackers can supply arbitrary organization IDs in URL parameters to list tables, retrieve column definitions, and...

EUVD-2026-68406

ToolJet before v3.16.208 fails to validate organization membership in database read routes, allowing any authenticated user to access other organizations' table schemas and row data. Attackers can supply arbitrary organization IDs in URL parameters to list tables, retrieve column definitions, and...