CVE-2026-109646

Frappe ERPNext versions prior to 15.106.0 and 16.x before 16.16.0 are vulnerable to an SQL injection vulnerability. This flaw originates from missing input validation in certain endpoints, allowing authenticated low-privileged attackers to submit specially crafted requests. Successful exploitatio...

CVE-2026-109646 Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation

Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated low-privileged attackers can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the...

CVE-2026-109639 Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests

Frappe ERPNext before 15.102.0 and 16.x before 16.8.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers with low privileges can send specially crafted requests to the affected endpoints to...

CVE-2026-109634 Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoints

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers with high privileges can send specially crafted requests to these endpoints to inject SQL and extract sensitive information fro...

CVE-2026-109609

Frappe ERPNext versions before 15.119.1 and 16.x before 16.32.0 are vulnerable to an SQL injection flaw. The root cause is a lack of input validation in certain endpoints. An authenticated attacker with low privileges can transmit specially crafted requests to these endpoints to execute arbitrary...

VulnCheck KEV: CVE-2026-0702

The VidShop – Shoppable Videos for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'fields' parameter in all versions up to, and including, 1.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-89234

The WP-Partner WordPress plugin (versions through 1.2.1 ) is vulnerable to an unauthenticated SQL injection due to the lack of proper sanitization and escaping of the 'id' parameter before it is used in a SQL query. This flaw allows an attacker to append additional SQL queries to extract sensitiv...

CVE-2026-96662

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection via 'bookingserviceid' Parameter in all versions up to, and including, 5.7.2 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-96662

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress is vulnerable to unauthenticated SQL Injection in all versions up to and including 5.7.2 . The root cause is insufficient escaping on the booking[service_id] parameter combined with a lack of sufficient preparation o...

CVE-2022-34265

CVE-2022-34265 Vulnerability Summary This vulnerability is due to improper string processing when executing SQL for the arguments of the functions Trunc and Extract used for date data in Django. By specifying the request parameters as is in the kind argument of Trunc or the lookupname argument of...

CVE-2026-104023

The Smart Popup by Supsystic plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.13.2 . The flaw exists in the 'sidx' parameter due to insufficient escaping of user-supplied input and a lack of proper SQL query preparation. This allows authenticated attackers...

CVE-2026-104724

The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to generic SQL Injection via FireBox Form Display Condition in all versions up to, and including, 3.1.13 due to insufficient escaping on the user supplied parameter and la...

CVE-2026-104724 FireBox <= 3.1.13 - Authenticated (Author+) SQL Injection via FireBox Form Display Condition

The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to generic SQL Injection via FireBox Form Display Condition in all versions up to, and including, 3.1.13 due to insufficient escaping on the user supplied parameter and la...

Linux Distros Unpatched Vulnerability : CVE-2026-41958

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A path traversal vulnerability exists in the unziphttp RemoteZipFile extract functionality of VisiData versions: dev commit 38b21f78. A specially crafted .zip...

CVE-2026-12260 SQL injection in the NetBoard CRM demo platform

SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable to blind attacks based on Boolean, error, time-based and UNION techniques. Exploitation allows attacke...

PT-2026-107500

A path traversal vulnerability exists in the unzip http RemoteZipFile extract functionality of VisiData versions: dev commit 38b21f78. A specially crafted .zip file can lead to arbitrary file write. An attacker can provide a crafted URL to trigger this vulnerability...

EUVD-2026-93949

On affected versions of CloudVision Portal on-premises or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user with sufficient high privileges could exploit this to extract unintended data from the Sensor...

CVE-2026-101153 Security Advisory 0188

On affected versions of CloudVision Portal on-premises or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user with sufficient high privileges could exploit this to extract unintended data from the Sensor...

PT-2026-107135

On affected versions of CloudVision Portal on-premises or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user with sufficient high privileges could exploit this to extract unintended data from the Sensor...

CVE-2026-101153: Improper Limitation of a Pathname to a Restricted Directory

On affected versions of CloudVision Portal on-premises or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user with sufficient high privileges could exploit this to extract unintended data from the Sensor...