290 matches found
CVE-2026-93528
📌 CVE-2026-93528: Divulgación no autenticada de datos de pedidos en NP Quote Request for WooCommerce • Tipo de vulnerabilidad: Divulgación de datos sensibles CWE-200 • Software afectado: woo-rfq-for-woocommerce 2.4.16 • Investigador original: Murad Islamzada • Proveedor: Neah Plugins Cyrus 1...
CVE-2025-67888
CVE-2025-67888 Vulnerabilidad de Inyección de Comandos del Sistema Operativo en Control Web Panel = 0.9.8.1208 admin/index.php Versiones Afectadas: Versión 0.9.8.1208 y versiones anteriores. Descripción de la Vulnerabilidad: La entrada de usuario pasada a través del parámetro GET "key" a...
Astra Linux – Vulnerability in OpenSSL
Issue Summary: Checking excessively long DH keys or parameters can be very slow. Impact Summary: Applications that use functions like DHcheck, DHcheckex, or EVPPKEYparamcheck to check DH keys or parameters may experience prolonged delays. If the keys or parameters are obtained from an untrusted...
CVE-2026-82527: Improper Neutralization of Special Elements used in an SQL Command
R2R through 3.6.6 contains a SQL injection vulnerability that allows unauthenticated attackers to inject SQL predicates into the chunks search query by manipulating the filter key parameter in the retrieval search endpoint. Attackers can exploit the direct interpolation of filter keys into the SQ...
WordPress Invisible Anti-Spam & CAPTCHA plugin <= 5.1 - Authenticated (Editor+) SQL Injection via 'key' Parameter vulnerability
Authenticated Editor+ SQL Injection via 'key' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant versions = 5.1...
CVE-2026-16094 Invisible Anti-Spam & CAPTCHA <= 5.1 - Authenticated (Editor+) SQL Injection via 'key' Parameter
The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to generic SQL Injection via the 'key' parameter in all versions up to, and including, 5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...
CVE-2026-16094
The CVE-2026-16094 entry concerns the WordPress plugin “Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms.” All versions up to 5.1 are affected by a generic SQL Injection via the 'key' parameter, caused by insufficient escaping of user input and lack of proper SQL query preparat...
PT-2026-72154
Name of the Vulnerable Software and Affected Versions Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms versions prior to 5.2 Description This issue is a generic SQL Injection, which occurs when an application fails to properly sanitize user input, allowing an attacker to...
CVE-2026-16094: Improper Neutralization of Special Elements used in an SQL Command
The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to generic SQL Injection via the 'key' parameter in all versions up to, and including, 5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...
CVE-2026-18616
A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5. The impacted element is the function server.setpeer of the file /cgi-bin/glc of the component wg-server.so Native Plugin. The manipulation of the argument publickey leads to command injection. Remote exploitation of the attack is...
CVE-2026-18615
A vulnerability was determined in GL-iNet GL-MT3000 up to 4.4.5. The affected element is the function wg-server.generatepublickey of the file /cgi-bin/glc of the component wg-server.so Native Plugin. Executing a manipulation of the argument privatekey can lead to command injection. The attack may...
CVE-2026-18616 GL-iNet GL-MT3000 wg-server.so Native Plugin glc server.set_peer command injection
A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5. The impacted element is the function server.setpeer of the file /cgi-bin/glc of the component wg-server.so Native Plugin. The manipulation of the argument publickey leads to command injection. Remote exploitation of the attack is...
EUVD-2026-52401
A vulnerability was determined in GL-iNet GL-MT3000 up to 4.4.5. The affected element is the function wg-server.generatepublickey of the file /cgi-bin/glc of the component wg-server.so Native Plugin. Executing a manipulation of the argument privatekey can lead to command injection. The attack may...
CVE-2026-16092 Improved Save Button <= 1.2.1 - Authenticated (Author+) Second-Order SQL Injection via 'meta_key' Parameter
The Improved Save Button plugin for WordPress is vulnerable to second-order SQL Injection via 'metakey' Custom Field via 'Save and Duplicate' Action in all versions up to, and including, 1.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
CVE-2026-16092 Improved Save Button <= 1.2.1 - Authenticated (Author+) Second-Order SQL Injection via 'meta_key' Parameter
The Improved Save Button plugin for WordPress is vulnerable to second-order SQL Injection via 'metakey' Custom Field via 'Save and Duplicate' Action in all versions up to, and including, 1.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
EUVD-2026-43531
A vulnerability was found in waooAI waoowaoo up to 0.4.1. Impacted is the function stablePublicIdFromStorageKey in the library src/lib/media/hash.ts of the component Media Handler. The manipulation of the argument storageKey results in improper authorization. The attack may be performed from...
SQL Injection
Overview Affected versions of this package are vulnerable to SQL Injection via the key parameter in the columnFilters array, which is directly interpolated into SQL queries with manual backtick wrapping. An attacker can extract sensitive database information, including password hashes, by injecti...
CVE-2026-8663
OS Command Injection vulnerability in Rapid7 InsightConnect RPM Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the repo, key, or name parameters due to insufficient input sanitization in shell command construction...
CVE-2026-56268 Flowise - Cross-Workspace Information Disclosure via chatflows/apikey Endpoint
Flowise before 3.1.2 contains an information disclosure vulnerability in the /api/v1/chatflows/apikey/:apikey endpoint. When the keyonly query parameter is omitted the default, the endpoint returns not only the chatflows bound to the supplied API key but also all chatflows across every workspace...