Debian dla-4873 : dovecot-auth-lua - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4873 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4873-1 [email protected]...

CVE-2026-119163: teamfunnelkit FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce: The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is…

The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'bwfancartid' parameter in all versions up to, and including, 3.8.5.2 due to insufficient escaping on the user supplied parameter and...

CVE-2026-15272: Shamalli Web 2.0 Directory plugin for WordPress: The Web 2.0 Directory plugin for WordPress is vulnerable to time-based SQL Injection via the 'w2dc_level_filter'…

The Web 2.0 Directory plugin for WordPress is vulnerable to time-based SQL Injection via the 'w2dclevelfilter' parameter in all versions up to, and including, 2.10.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This mak...

PT-2026-134500

Name of the Vulnerable Software and Affected Versions WP Directory Kit versions prior to 1.6.1 Description An issue exists where unauthenticated attackers can perform SQL Injection, a technique used to interfere with the queries that an application makes to its database. This occurs due to...

PT-2026-134457

The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'bwfan cart id' parameter in all versions up to, and including, 3.8.5.2 due to insufficient escaping on the user supplied parameter and...

VulnCheck KEV: CVE-2025-5569

A vulnerability was found in IdeaCMS up to 1.7 and classified as critical. This issue affects the function Article/Goods of the file /api/v1.index.article/getList.html. The manipulation of the argument Field leads to sql injection. The attack may be initiated remotely. Upgrading to version 1.8 is...

Oracle E-Business Suite 12.2.15 SQL Injection

Oracle E-Business Suite versions 12.2.3 through 12.2.15 contain an unauthenticated SQL injection issue in the Thin Client Framework servlet. The supplied proof of concept sends crafted TCF requests to execute SQL as the APPS database user. https://packetstorm.news/download/238651...

PT-2026-134480

Name of the Vulnerable Software and Affected Versions Newsletters plugin for WordPress versions prior to 4.18.2 Description Authenticated attackers with subscriber-level access and above can perform a time-based SQL Injection. This occurs due to insufficient escaping of the user-supplied id...

PT-2026-134509

Name of the Vulnerable Software and Affected Versions Web 2.0 Directory versions prior to 2.10.13 Description An issue exists where unauthenticated attackers can perform time-based SQL Injection. This occurs because the w2dc level filter parameter is not properly escaped and the SQL query is not...

PT-2026-134466

Name of the Vulnerable Software and Affected Versions WP2LEADS versions prior to 3.5.7 Description Authenticated attackers with Subscriber-level access and above can perform a time-based SQL Injection. This occurs because the plugin fails to sufficiently escape the order parameter and lacks prope...

FreePBX Endpoint Manager 17.0.2 SQL Injection / Remote Code Execution

FreePBX Endpoint Manager versions before 15.0.66, 16.0.89, and 17.0.3 contain an unauthenticated SQL injection vulnerability that allows database manipulation and remote code execution. Included proof of concept inserts a cron job to execute commands as asterisk...

CVE-2026-109197: wpdirectorykit WP Directory Kit: The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'idfield' parameter in all…

The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'idfield' parameter in all versions up to, and including, 1.6.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVE-2026-101325: contrid Newsletters: The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions…

The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 4.18.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

FreeBSD : phpMyAdmin -- Multiple vulnerabilities, no fix available (e6b90d23-d49d-11f1-bae2-3497f65b111b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the e6b90d23-d49d-11f1-bae2-3497f65b111b advisory. VulnCheck reports: Seven vulnerabilities in phpMyAdmin up to and including 5.2.3 were publishe...

Fedora 45 : wordpress (2026-3c05ab9fa4)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-3c05ab9fa4 advisory. WordPress 7.1.3 Maintenance and Security Release Security updates included in this release - A stored XSS on the Comments administration page, exploitable vi...

CVE-2024-27956

CVE-2024-27956 Note Build wordpress: docker-compose -f stack.yml up Install plugin: 1. WordPress dashboard, choose Plugins Add New 2. Click Upload Plugin 3. Choose File - wp-automatic.zip - Install Now 4. After the installation is complete, click Activate Plugin Exploit...

CVE-2023-42284

Disclaimer For educational purpose only! Details Proof of concept for CVE-2023-42284. Tyk Gateway is vulnerable to SQL injection. Fixed in 5.0.7 version. The URL parameter ‘apiversion’ of the "https:///api/errors/count/...?res=day&p=...&apiversion=&apiid=..."is vulnerable to Blind SQL injection...

CVE-2025-68999-POC

CVE-2025-68999 Happy Addons for Elementor prepare, but then drops $entry-metakey straight into the SQL string without escaping: $records = " $duplicatedpostid, '$entry-metakey', '$value' "; // ... $wpdb-query $query ; Because metakey comes from the database, the code treats it as trusted. But...

heroku-CVE-2013-0269

heroku-CVE-2013-0269 Inspect all of your heroku apps to see if they are running a vulnerable version of JSON Background A security vulnerability has been found in the Ruby JSON gem. This is the root cause for the recently-announced MySQL injection issue in Rails. A new release of the JSON gem is...

CVE-2026-57821-PoC-Exploit

CVE-2026-57821 – Apache Fineract SQL Injection LEGAL & ETHICAL NOTICE This toolkit is provided strictly for educational, training, and authorized security testing purposes. Unauthorized use against any system without explicit written permission is illegal and violates computer crime laws. The...