CVE-2026-100847 AzuraCast before 0.23.8 DQL Injection via sortOrder

AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder API parameter of AbstractSearchableListAction.php. Attackers can inject arbitrary DQL expressions through the sortOrder parameter to extract sensitive database information including user credentials and station settin...

CVE-2026-100847

AzuraCast versions prior to 0.23.8 are vulnerable to a DQL injection flaw within the sortOrder API parameter of the AbstractSearchableListAction.php file. Attackers can exploit this by injecting arbitrary DQL expressions to extract sensitive database information , including user credentials and s...

EUVD-2026-87841

AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder API parameter of AbstractSearchableListAction.php. Attackers can inject arbitrary DQL expressions through the sortOrder parameter to extract sensitive database information including user credentials and station settin...

CVE-2026-100847 AzuraCast before 0.23.8 DQL Injection via sortOrder

AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder API parameter of AbstractSearchableListAction.php. Attackers can inject arbitrary DQL expressions through the sortOrder parameter to extract sensitive database information including user credentials and station settin...

CVE-2026-100847: Improper Neutralization of Special Elements used in an SQL Command

AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder API parameter of AbstractSearchableListAction.php. Attackers can inject arbitrary DQL expressions through the sortOrder parameter to extract sensitive database information including user credentials and station settin...

CVE-2026-89237

The Bluff Post WordPress plugin through 1.1.1 does not sanitise and escape parameters before using them as identifiers in a SQL query, allowing unauthenticated attackers to append additional SQL and extract sensitive information from the database...

CVE-2026-62262

Piwigo is a full featured open source photo gallery application for the web. In 17.0.0beta1 and earlier, when rating is enabled, an unauthenticated guest can call pwg.images.filteredSearch.create with a crafted ratings value and then open the returned search URL. include/wsfunctions/pwg.images.ph...

CVE-2026-62262 Piwigo: Unauthenticated SQL injection in `pwg.images.filteredSearch.create`

Piwigo is a full featured open source photo gallery application for the web. In 17.0.0beta1 and earlier, when rating is enabled, an unauthenticated guest can call pwg.images.filteredSearch.create with a crafted ratings value and then open the returned search URL. include/wsfunctions/pwg.images.ph...

CVE-2026-62262: Improper Neutralization of Special Elements used in an SQL Command

Piwigo is a full featured open source photo gallery application for the web. In 17.0.0beta1 and earlier, when rating is enabled, an unauthenticated guest can call pwg.images.filteredSearch.create with a crafted ratings value and then open the returned search URL. include/wsfunctions/pwg.images.ph...

CVE-2026-88402: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allows attackers to access sesntive database information via injecting crafted SQL statements...

PT-2026-96288

Name of the Vulnerable Software and Affected Versions nocobase version 2.1.21 Description A SQL injection issue exists in the checkSQL function, which allows attackers to access sensitive database information by injecting crafted SQL statements. SQL injection is a technique where malicious SQL co...

CVE-2026-88402

A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allows attackers to access sesntive database information via injecting crafted SQL statements...

CVE-2026-15275: Improper Neutralization of Special Elements used in an SQL Command

The WP Multi Store Locator Pro plugin for WordPress is vulnerable to generic SQL Injection via the 'storelocatoresearchradius' parameter in all versions up to, and including, 4.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-16588: Improper Neutralization of Special Elements used in an SQL Command

The WP Directory Kit plugin for WordPress is vulnerable to blind SQL Injection via the 'orderby' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

CVE-2026-79573

L-ONE v1.0.0 is vulnerable to multiple SQL injection flaws within the /attachment/getBusinessUploadList component. The root cause is the improper neutralization of special elements in the busid , id , and taskid parameters. An attacker can exploit these vulnerabilities by submitting a crafted SQL...

CVE-2026-77189: Improper Neutralization of Special Elements used in an SQL Command

The Charitable – Donation & Fundraising Platform Donation Forms, Recurring Donations & Fundraising Campaigns plugin for WordPress is vulnerable to generic SQL Injection via 'order' Shortcode Attribute in all versions up to, and including, 1.8.12.1 due to insufficient escaping on the user supplied...

CVE-2026-12248: Improper Neutralization of Special Elements used in an SQL Command

The WPML Multilingual CMS plugin for WordPress is vulnerable to SQL Injection via the 'sorting' parameter in all versions up to, and including, 4.9.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible fo...

SQL Injection

Overview pimcore/pimcore is a content & product management framework CMS/PIM/E-Commerce. Affected versions of this package are vulnerable to SQL Injection via improper validation of class definition UIDs and unquoted concatenation of class IDs in SQL queries. An attacker can access sensitive...

CVE-2026-18881

The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to blind SQL Injection via the filterdatacommentcount parameter of the public tableongettabledata AJAX action in all versions up to, and including, 1.0.5.1. This is due to insufficient escaping on the user-supplied...

CVE-2026-15403: Improper Neutralization of Special Elements used in an SQL Command

The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to blind SQL Injection via the 'field' parameter in all versions up to, and including, 2.9.9.6.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Thi...