116 matches found
CVE-2026-72807
SiYuan versions before v3.7.4 contain a second-order SQL injection vulnerability in attribute-view template columns that expose the queryBlocks function, which executes raw SQL using string substitution instead of parameterized queries. Attackers can distribute malicious SiYuan documents or...
CVE-2026-13171
The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to create WordPress user accounts for arbitrary email addresses and inject order records...
EUVD-2026-57091
The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for a database-backed choice field, allowing subscriber-level users to perform second-order SQL injection...
EUVD-2026-57074
The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to create WordPress user accounts for arbitrary email addresses and inject order records...
CVE-2026-13171
The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to create WordPress user accounts for arbitrary email addresses and inject order records...
CVE-2026-15281
The WordPress plugin User Access Manager (v
EUVD-2026-53179
The User Access Manager plugin for WordPress is vulnerable to Second-Order SQL Injection via the 'id' parameter of the wpajaxsave-attachment-compat AJAX action in versions up to, and including, 2.3.12. This is due to insufficient validation on the objectId value stored in the saveAjaxAttachmentDa...
CVE-2026-15281 User Access Manager <= 2.3.12 - Authenticated (Subscriber+) SQL Injection
The User Access Manager plugin for WordPress is vulnerable to Second-Order SQL Injection via the 'id' parameter of the wpajaxsave-attachment-compat AJAX action in versions up to, and including, 2.3.12. This is due to insufficient validation on the objectId value stored in the saveAjaxAttachmentDa...
CVE-2026-18801
OpenMeter is affected by a stored/second-order SQL injection in the handling of customer usage-attribution values. A user who can create or update a customer can store a crafted value in usageAttribution.key or usageAttribution.subjectKeys, which is later incorporated into a ClickHouse WITH map(....
CVE-2026-16087
The Icegram Engage – Popups, Optins, CTAs & Lead Generation plugin for WordPress is vulnerable to second-order SQL Injection via 'messagesid' Parameter in all versions up to, and including, 3.1.42 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...
EUVD-2026-51742
The Icegram Engage – Popups, Optins, CTAs & Lead Generation plugin for WordPress is vulnerable to second-order SQL Injection via 'messagesid' Parameter in all versions up to, and including, 3.1.42 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...
CVE-2026-16087
The Icegram Engage – Popups, Optins, CTAs & Lead Generation plugin for WordPress is vulnerable to second-order SQL Injection via 'messagesid' Parameter in all versions up to, and including, 3.1.42 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...
CVE-2026-16087 Icegram Engage <= 3.1.42 - Authenticated (Contributor+) Second-Order SQL Injection via 'messages[][id]' Parameter
The Icegram Engage – Popups, Optins, CTAs & Lead Generation plugin for WordPress is vulnerable to second-order SQL Injection via 'messagesid' Parameter in all versions up to, and including, 3.1.42 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...
CVE-2026-16087
The CVE-2026-16087 entry concerns the Icegram Engage WordPress plugin (≤ 3.1.42). A second-order SQL Injection is possible via the messages[][id] parameter, arising from insufficient escaping and lack of $wpdb->prepare() in a SQL IN() clause. The malicious value is first saved to post meta by ...
CVE-2026-16092
The Improved Save Button plugin for WordPress is vulnerable to second-order SQL Injection via 'metakey' Custom Field via 'Save and Duplicate' Action in all versions up to, and including, 1.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
CVE-2026-16092
The CVE-2026-16092 entry concerns The Improved Save Button plugin for WordPress. A second-order SQL injection affects all versions up to 1.2.1 via the ‘meta_key’ Custom Field when using the ‘Save and Duplicate’ action. Root cause: insufficient escaping of user-supplied parameters and inadequate p...
CVE-2026-16092 Improved Save Button <= 1.2.1 - Authenticated (Author+) Second-Order SQL Injection via 'meta_key' Parameter
The Improved Save Button plugin for WordPress is vulnerable to second-order SQL Injection via 'metakey' Custom Field via 'Save and Duplicate' Action in all versions up to, and including, 1.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
CVE-2026-15673
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via 'checkoutpaymentplans' and 'orderstatus' Settings in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied...
CVE-2025-71392
SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command. An authenticated System User with OWNER or EDITOR roles can create tables or fields with malicious names containing SurrealQL. When a...
CVE-2026-13767
The Quiz Master Next plugin for WordPress is vulnerable to SQL Injection via stored quiz page data in versions up to, and including, 11.2.0. This is due to insufficient escaping on the user-supplied 'pages' parameter persisted by the qsmajaxsavepages AJAX handler sanitizetextfield only and lack o...