Radius Synergies Radius Xenia M2M Platform SQL injection vulnerability

The Radius Synergies Radius Xenia M2M Platform contains an SQL injection vulnerability. This vulnerability stems from insufficient input validation in the password recovery functionality within its web management interface. Unauthenticated remote attackers can supply specially crafted SQL queries...

CVE-2026-114358: Radius Synergies Radius Xenia M2M Platform: This vulnerability exists in the Radius Xenia M2M Platform due to insufficient validation of user supplied input in the…

This vulnerability exists in the Radius Xenia M2M Platform due to insufficient validation of user supplied input in the password recovery functionality in the web management interface. An unauthenticated remote attacker could exploit this vulnerability by supplying crafted SQL query through input...

CVE-2026-115965: BuddyPress: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyPress…

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in BuddyPress BuddyPress buddypress allows Blind SQL Injection.This issue affects BuddyPress: from n/a through 14.5.2...

PT-2026-130662

The vTables WordPress plugin before 0.3 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and extract data from the database...

VulnCheck KEV: CVE-2026-96662

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection via 'bookingserviceid' Parameter in all versions up to, and including, 5.7.2 due to insufficient escaping on the user supplied parameter and lack of...

Crocoblock JetEngine SQL injection vulnerability

Crocoblock JetEngine versions 3.9.0.1 and earlier contain an SQL injection vulnerability. This vulnerability stems from improper handling of special elements within SQL commands, potentially leading to SQL injection attacks...

Oracle Application Object Library 12.2.15 SQL Injection

Oracle Application Object Library versions 12.2.3 through 12.2.15 contain an unauthenticated SQL injection vulnerability that may permit application compromise...

CVE-2026-93855: brewlabs SendPress Newsletters: The SendPress Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'subscriberid'…

The SendPress Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'subscriberid' parameter in all versions up to, and including, 1.26.1.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

Arista VeloCloud Orchestrator On-Prem 6.4.2.11 SQL Injection Detector

Arista VeloCloud Orchestrator On-Prem versions 5.2 before 5.2.3.18, 6.1 before 6.1.3.10, and 6.4 before 6.4.2.12 contain an SQL injection vulnerability. This offline Python tool assesses CSV or JSON inventory records against fixed-build thresholds...

WordPress Social Web Suite SQL injection vulnerability

WordPress Social Web Suite versions 4.1.12 and earlier contain an SQL injection vulnerability. This vulnerability stems from insufficient escaping of the ‘excludeposts’ parameter and inadequate preparation of SQL queries. Unauthenticated attackers can append additional SQL queries to extract...

CVE-2026-115964: StylemixThemes Motors: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes…

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Blind SQL Injection.This issue affects Motors: from n/a through 1.4.126...

WordPress BuddyPress SQL injection vulnerability

WordPress BuddyPress versions 14.5.2 and earlier contain an SQL injection vulnerability. This vulnerability stems from improper handling of special elements within SQL commands, potentially leading to blind SQL injection...

CVE-2026-61996: favethemes MLS On The Fly: Subscriber SQL Injection in MLS On The Fly <= 1.8.1.5 versions.

Subscriber SQL Injection in MLS On The Fly = 1.8.1.5 versions...

WordPress SendPress Newsletters SQL injection vulnerability

WordPress SendPress Newsletters versions 1.26.1.20 and earlier contain an SQL injection vulnerability. This vulnerability stems from insufficient escaping of the subscriberid parameter and inadequate preparation of SQL queries, potentially allowing unauthenticated attackers to perform time-based...

VulnCheck KEV: CVE-2026-32557

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in BookingWP WooCommerce Appointments woocommerce-appointments allows Blind SQL Injection.This issue affects WooCommerce Appointments: from n/a through 5.3.2...

PT-2026-132393

SQL injection allowing an authenticated user with access to ACL management to read and modify the Centreon database...

CVE-2026-61569

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated streamer login at objects/login.json.php passes the user parameter to Streamer::get in objects/Streamer.php, where it is interpolated into a single-quoted MariaDB SELECT without parameterization or escaping. Although...

CVE-2026-54455

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, activity DataGrid date filtering in home:CallsDataGrid and activity:ActivityDataGrid uses request-controlled period, startDate and endDate parameters without...

CVE-2026-61564

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint install/checkConfiguration.php assembles videos/configuration.php by interpolating request parameters, including webSiteRootURL, into single-quoted PHP string literals without escaping. An attacker can...

CVE-2026-61569 AVideo-Encoder: pre-authentication streamer-login SQL injection

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated streamer login at objects/login.json.php passes the user parameter to Streamer::get in objects/Streamer.php, where it is interpolated into a single-quoted MariaDB SELECT without parameterization or escaping. Although...