3336 matches found
CVE-2026-15018 Database Collation Fix <= 1.2.10 - Unauthenticated SQL Injection via 'force-collation-algorithm' Parameter
The Database Collation Fix plugin for WordPress is vulnerable to time-based SQL Injection via the 'force-collation-algorithm' parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
PT-2026-67086
The Icegram Mailer plugin for WordPress is vulnerable to SQL Injection via the 'fields' parameter in versions up to, and including, 1.0.12. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the Icegram Mailer Logs...
CVE-2026-55100
hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenates unencoded identifier values including name, username, group, role, and version into Vault request paths and query strings instead of using encodeURIComponent and...
CVE-2026-55100
CVE-2026-55100 affects the Node.js module hashi-vault-js . The vulnerable component is the internal path construction in src/Vault.js, which concatenates unencoded identifier values (e.g., name, username, group, role, version) into request paths and query strings instead of using proper encoding,...
CVE-2026-55100 hashi-vault-js has a path traversal and query parameter injection
hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenates unencoded identifier values including name, username, group, role, and version into Vault request paths and query strings instead of using encodeURIComponent and...
CVE-2026-55100
hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenates unencoded identifier values including name, username, group, role, and version into Vault request paths and query strings instead of using encodeURIComponent and...
CVE-2026-55100 hashi-vault-js has a path traversal and query parameter injection
hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenates unencoded identifier values including name, username, group, role, and version into Vault request paths and query strings instead of using encodeURIComponent and...
hashi-vault-js has a path traversal and query parameter injection
Summary The hashi-vault-js library is vulnerable to path traversal and query string injection due to the lack of proper encoding of identifiers in path segments and query strings. This allows attackers to manipulate the request URL and potentially access unintended downstream endpoints or inject...
GHSA-G956-2F74-RMV7 hashi-vault-js has a path traversal and query parameter injection
Summary The hashi-vault-js library is vulnerable to path traversal and query string injection due to the lack of proper encoding of identifiers in path segments and query strings. This allows attackers to manipulate the request URL and potentially access unintended downstream endpoints or inject...
CVE-2025-67650 Authenticated SQL Injection in PHP Jabbers scripts
An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. Improper neutralization of input provided by an authenticated user into parameters responsible for sorting functions allows an attacker to perform SQL Injection attacks. This issue was fixed in the...
PT-2026-66859
Name of the Vulnerable Software and Affected Versions SourceCodester Modern Loan Management System version 1.0 Description An issue exists in the 'ajaxData.php' endpoint where improper handling of the district id, division id, region id, and ward id parameters allows for SQL Injection. SQL...
EUVD-2025-210575
SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin/deletegroup.php?id=1...
CVE-2025-69930
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /printmembershipcard.php?id=1...
EUVD-2026-51156
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in UMAI Vision Traffic Analysis System allows SQL Injection. This issue affects Traffic Analysis System: from 30 before 34...
WordPress Chaty Pro plugin <= 3.5.5 - Authenticated (Subscriber+) SQL Injection vulnerability
Authenticated Subscriber+ SQL Injection vulnerability discovered by h0xilo in WordPress Plugin Chaty Pro versions = 3.5.5...
EUVD-2025-210533
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in updatestudent.php via parameters fname and studentclass...
EUVD-2025-210535
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in updatepassword.php via the parameter newpassword...
PT-2026-66585
Name of the Vulnerable Software and Affected Versions CodeAstro Membership Management System version 1.0 Description An issue exists that allows SQL Injection via the '/edit member.php' endpoint through the id parameter. SQL Injection is a technique where malicious SQL statements are inserted int...