CVE-2026-94539: Improper Neutralization of Special Elements used in an SQL Command

The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to time-based SQL Injection via the 'sortby' parameter in all versions up to, and including, 3.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-96267: Improper Neutralization of Special Elements used in an SQL Command

The WP Visitor Statistics Real Time Traffic plugin for WordPress is vulnerable to generic SQL Injection via the 'fullRef' parameter in all versions up to, and including, 8.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...

PT-2026-104529

Name of the Vulnerable Software and Affected Versions SaveTo Wishlist Lite versions prior to 1.1.5 Description An issue exists where parameters are not sanitized or escaped before being used in the ORDER BY clause of a SQL query. This allows unauthenticated attackers to append additional SQL...

CVE-2026-92923: Improper Neutralization of Special Elements used in an SQL Command

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise and escape a parameter before using it in a SQL statement, allowing users with a role as low as subscriber to perform blind SQL injection attacks and read arbitrary data from the database. Version 2.0.18 removed...

CVE-2026-18443: Improper Neutralization of Special Elements used in an SQL Command

The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via the 'accessprivileges' parameter in all versions up to, and including, 8.97.0 due to insufficient escaping on the user supplied parameter and lack of sufficien...

CVE-2023-37941

Exploitation of Pickle RCE within Superset's Default Cache Information Author Dinis Cruz Project Superset Description Apache's superset presents different options for caching, all of which based on Flask-Caching. A built-in cache is provided which serializes values for later retreival. This...

adminer_CVE-2021-43008

CVE-2021-43008 — Vulnerabilidad Adminer Lectura arbitraria de archivos a través de un servidor MySQL malicioso 1. ¿Qué es Adminer? Adminer es una herramienta web PHP que permite administrar fácilmente bases de datos MySQL, PostgreSQL, SQLite o SQL Server. Se despliega comúnmente como una...

CVE-2026-94592

Armatura One's database initialization routine assigns a fixed, vendor-defined password to the database superuser account at creation time, rather than generating a unique password per installation. An individual with access to the server operating system and knowledge of this value can...

CVE-2026-94593

Armatura One's backup and restore routine records the full database connection command, including the superuser password, in plain text in a log file on the host. Credentials disclosed by this finding can be used to access the database when access to the server operating system is available...

CVE-2026-94592 Armatura LLC Armatura One Use of Hard-coded Credentials

Armatura One's database initialization routine assigns a fixed, vendor-defined password to the database superuser account at creation time, rather than generating a unique password per installation. An individual with access to the server operating system and knowledge of this value can...

CVE-2026-94592

The Armatura One platform contains a vulnerability where the database initialization routine assigns a fixed, vendor-defined password to the database superuser account instead of generating a unique one. An attacker with server operating system access and knowledge of this hard-coded value can au...

CVE-2024-49681

CVE-2024-49681 WP Sessions Time Monitoring Full Automatic = 1.0.9 - Inyección SQL sin autenticar Descripción: El plugin WP Sessions Time Monitoring Full Automatic para WordPress es vulnerable a inyección SQL en versiones hasta la 1.0.9 inclusive, debido a un escape insuficiente en el parámetro...

CVE-2022-31890

CVE-2022-31890 para osTicket | Sistema de Ticketing de Soporte Apodo: python nickname.py The output of the first nickname in the table. Contraseña: python password.py The output of the first password in the table. Salida a archivo: python dumpFile.py cat dump.txt || nickname::password Salida a...

ICE Has Been Dumping Protester Photos Into a Palantir Database

DHS agents not only tracked and intimidated people observing ICE activity in Maine, but stored information about them in a database run on Palantir software, newly unsealed court filings say...

CVE-2014-125130

CodeArt Google MP3 Audio Player plugin google-mp3-audio-player for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to retrieve sensitive files by supplying a path-traversal payload in the file parameter of directdownload.php...

CVE-2014-125130 CodeArt Google MP3 Audio Player 1.0.11 Arbitrary File Read via direct_download.php

CodeArt Google MP3 Audio Player plugin google-mp3-audio-player for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to retrieve sensitive files by supplying a path-traversal payload in the file parameter of directdownload.php...

EUVD-2014-9822

CodeArt Google MP3 Audio Player plugin google-mp3-audio-player for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to retrieve sensitive files by supplying a path-traversal payload in the file parameter of directdownload.php...

CVE-2014-125130 CodeArt Google MP3 Audio Player 1.0.11 Arbitrary File Read via direct_download.php

CodeArt Google MP3 Audio Player plugin google-mp3-audio-player for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to retrieve sensitive files by supplying a path-traversal payload in the file parameter of directdownload.php...

CVE-2026-69084-PoC

CVE-2026-69084 / CVE-2026-69085 — SiYuan Arbitrary SQL Execution & SQLi CVE-2026-69084: Arbitrary SQL Execution via /api/search/searchEmbedBlock CVE-2026-69085: SQL Injection via /api/filetree/searchDocs CVSS 9.9 Critical each · CWE-89 · SiYuan --check 2. DB-write proof: CREATE TABLE + INSERT...

CVE-langgraph

cve-id ⚡ Uso Sencillo Use este proyecto únicamente en entornos seguros y autorizados, como: Máquinas virtuales locales Contenedores Docker Configuraciones de laboratorio aisladas Entornos de pruebas de penetración autorizados Ejemplo de configuración: git clone cd Project use python follow below...