31535 matches found
EUVD-2026-37049
Subscriber SQL Injection in Attendance Manager = 0.6.2 versions...
WordPress WP Review Slider Pro plugin <= 12.6.8 - Authenticated (Subscriber+) SQL Injection vulnerability
Authenticated Subscriber+ SQL Injection vulnerability discovered by h0xilo in WordPress Plugin WP Review Slider Pro versions = 12.6.8...
WordPress Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress plugin <= 2.0.13 - Authenticated (Administrator+) PHP Object Injection vulnerability
Authenticated Administrator+ PHP Object Injection vulnerability discovered by Duc Long in WordPress Plugin Counter Box versions = 2.0.13...
PT-2026-49627
The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'curselrevs' parameter of the wpfb find reviews AJAX action in versions up to, and including, 12.6.8. This is due to the handler reading $ POST'curselrevs' raw with no sanitization or type casting, then...
PT-2026-50081
Unauthenticated PHP Object Injection in SeaFood Company = 1.4 versions...
Injection at axios dependency in Bamboo Data Center
This High severity Injection vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This Injection vulnerability, with a CVSS Score of 8.2 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H allows an unauthenticated attack...
Injection axios Dependency in Bitbucket Data Center
This High severity Injection vulnerability was introduced in versions 9.4.12, 10.2.0, and 10.3.0 of Bitbucket Data Center. This Injection vulnerability, with a CVSS Score of 8.2 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H allows an unauthenticated attacker to modify the...
Injection org.apache.tomcat:tomcat-catalina Dependency in Jira Software Data Center
This is a vulnerability in a non-Atlassian dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. This Critical severity Injection vulnerability was introduced in versions 9.12.1, 10.0.0, 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0,...
EUVD-2026-36960
Unauthenticated SQL Injection in SpeakOut! Email Petitions = 4.6.5 versions...
CVE-2026-40771
Unauthenticated SQL Injection in Contest Gallery = 28.1.6 versions...
CVE-2026-52700 WordPress WCMultiShipping plugin <= 3.0.2 - SQL Injection vulnerability
Subscriber SQL Injection in WCMultiShipping = 3.0.2 versions...
CVE-2026-49776 WordPress GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites plugin <= 2.32.6 - SQL Injection vulnerability
Unauthenticated SQL Injection in GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites = 2.32.6 versions...
CVE-2026-48874 WordPress GamiPress plugin <= 7.8.7 - SQL Injection vulnerability
Subscriber SQL Injection in GamiPress = 7.8.7 versions...
CVE-2026-42687
The CVE-2026-42687 entry concerns the WordPress EventPrime plugin (versions ≤ 4.3.2.1). It describes an unauthenticated PHP Object Injection vulnerability in EventPrime, with a CVSS v3.1 base score of 8.1 (HIGH) and a network attack vector, no user interaction, and high impact on confidentiality,...
CVE-2026-42386
The CVE-2026-42386 entry concerns the WordPress Order Delivery Date for WooCommerce plugin (versions
CVE-2026-39530
CVE-2026-39530 involves the WordPress plugin SpeakOut! Email Petitions, affecting versions
CVE-2026-39511 WordPress WP Photo Album Plus plugin <= 9.1.08.001 - SQL Injection vulnerability
Unauthenticated SQL Injection in WP Photo Album Plus = 9.1.08.001 versions...
CVE-2026-39493
CVE-2026-39493 : The WordPress plugin Simply Schedule Appointments (versions