PT-2026-66717

The WP Go Maps WordPress plugin before 10.1.04 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...

CVE-2025-69935

CodeAstro Membership Management System 1.0 is vulnerale to SQL Injection in the report.php and revenuereport.php via the fromDate parameter...

CVE-2026-23985 Apache Superset: Regular Expression Denial of Service (ReDoS) in SQL Parser

A Regular Expression Denial of Service ReDoS vulnerability exists in Apache Superset versions 1.5.0 through 5.0.0. The vulnerability is located in the sqlparse.py component, specifically within the SQLREGEX used for parsing SQL statements in the sqlparse library integration. The affected regular...

Web-Security-Vulnerability-Scanner

Web-Security-Vulnerability-Scanner Pyt...

CVE-2026-15153 WP Hotel Booking < 2.3.2 - Hotel Manager+ SQL Injection via Booking List Search

The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query, allowing users holding the WP Hotel Booking WordPress plugin before 2.3.2's booking-management roles to perform SQL injection attacks...

CVE-2026-48448

Adobe Campaign Classic (ACC) is affected by an SQL Injection vulnerability (CWE-89) due to improper neutralization of special elements in SQL commands. The issue could allow an attacker to read files on the file system without user interaction, with CVSS v3.1 base metrics: AV:N/AC:L/PR:N/UI:N/S:C...

EUVD-2025-210539

kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /doctor/edit-patient.php?editid=1...

PT-2026-66377

Name of the Vulnerable Software and Affected Versions Online Scheduling and Appointment Booking System versions prior to 27.8 Description Unauthenticated attackers can perform SQL injection attacks via front-end booking requests. The issue occurs because the system fails to sanitize or properly...

EUVD-2025-210554

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /editmember.php?id=1...

CVE-2025-69931

The CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the /delete_membership.php?id=1 endpoint. This vulnerability, identified as CVE-2025-69931 , stems from the improper neutralization of special elements used in an SQL command. The impact is rated as CRITICAL with a C...

PT-2026-66588

Name of the Vulnerable Software and Affected Versions SourceCodester Tailor Management System version 1.0 Description An issue exists that allows SQL Injection, a technique where malicious SQL statements are inserted into entry fields for execution, via the 'addmeasurement.php' endpoint using the...

PT-2026-66583

Name of the Vulnerable Software and Affected Versions CodeAstro Membership Management System version 1.0 Description An issue exists that allows SQL Injection via the '/delete members.php' endpoint through the id parameter. SQL Injection is a technique where malicious SQL statements are inserted...

PT-2026-66352

Name of the Vulnerable Software and Affected Versions Adobe Campaign Classic affected versions not specified Description An Improper Neutralization of Special Elements used in an SQL Command, known as SQL Injection, allows an attacker to disclose sensitive memory and gain read access to the file...

PHP 8.4.x < 8.4.24 Multiple Vulnerabilities SQLI

The version of PHP installed on the remote host is prior to 8.4.24. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.4.24 advisory. - Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8....

PT-2026-66505

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in UMAI Vision Traffic Analysis System allows SQL Injection. This issue affects Traffic Analysis System: from 30 before 34...

CVE-2026-5490 DriveLock SQL Injection Privilege Escalation Vulnerability

DriveLock SQL Injection Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of DriveLock. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP por...

CVE-2026-8339

A SQL injection vulnerability exists in the Coverity Connect SOAP API for versions between 2024.6.0 and 2026.3.0 inclusive. A malicious, authenticated threat actor who sends a specially crafted payload can achieve full read access to database contents and other unauthorized commands...

GHSA-PC2W-4MQ8-32QW @dynatrace-oss/dynatrace-mcp-server's create_dynatrace_notebook missing the human-approval gate

Summary A missing human-approval gate on the createdynatracenotebook tool allows a caller to create persistent tenant-visible documents containing arbitrary content including embedded DQL that other users execute when opening the notebook without operator consent. Details dynatrace-mcp-server...

CVE-2026-11973 WP-Lister Lite for eBay <= 3.8.8 - Authenticated (Shop Manager+) SQL Injection via 'orderby' Parameter

The WP-Lister Lite for eBay plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2026-63230

A pre-authentication error-based SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable account takeover, via the SCORM report endpoint...