devsecops-vulnerable-app

!CAUTION This application is intentionally vulnerable...

CVE-2026-115603

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Advanced Ads GmbH Advanced Ads – Tracking advanced-ads-tracking allows Blind SQL Injection.This issue affects Advanced Ads – Tracking: from n/a before 4.0.0...

CVE-2026-115603 WordPress Advanced Ads – Tracking plugin < 4.0.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Advanced Ads GmbH Advanced Ads – Tracking advanced-ads-tracking allows Blind SQL Injection.This issue affects Advanced Ads – Tracking: from n/a before 4.0.0...

EUVD-2026-112121

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Advanced Ads GmbH Advanced Ads – Tracking advanced-ads-tracking allows Blind SQL Injection.This issue affects Advanced Ads – Tracking: from n/a before 4.0.0...

CVE-2026-115603 WordPress Advanced Ads – Tracking plugin < 4.0.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Advanced Ads GmbH Advanced Ads – Tracking advanced-ads-tracking allows Blind SQL Injection.This issue affects Advanced Ads – Tracking: from n/a before 4.0.0...

CVE-2026-115603

The Advanced Ads – Tracking WordPress plugin (versions before 4.0.0 ) is vulnerable to a Blind SQL Injection (CWE-89). This vulnerability is caused by the Improper Neutralization of Special Elements used in an SQL command. Exploitation of this flaw could allow an attacker to compromise the databa...

Vulnerability fixed in Arista VeloCloud Orchestrator (VCO) on-premises

Arista has addressed a critical vulnerability in VeloCloud Orchestrator VCO On-Premises. The vulnerability, identified as CVE-2026-114625, carries a CVSS score of 9.9 and involves SQL injection. An authenticated malicious actor can exploit this vulnerability remotely to gain elevated privileges a...

CVE-2026-111411

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Blind SQL Injection.This issue affects FunnelKit Automations: from n/a through 3.8.5.2...

CVE-2026-111850

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in BuddyPress BuddyPress buddypress allows SQL Injection.This issue affects BuddyPress: from n/a through 14.5.2...

CVE-2026-115607

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Crowd Favorite DXP ToolKit dxp-toolkit allows SQL Injection.This issue affects DXP ToolKit: from n/a through 2.0.1...

CVE-2026-111850 WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in BuddyPress BuddyPress buddypress allows SQL Injection.This issue affects BuddyPress: from n/a through 14.5.2...

CVE-2026-111850 WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in BuddyPress BuddyPress buddypress allows SQL Injection.This issue affects BuddyPress: from n/a through 14.5.2...

EUVD-2026-112070

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in BuddyPress BuddyPress buddypress allows SQL Injection.This issue affects BuddyPress: from n/a through 14.5.2...

CVE-2026-111850

The BuddyPress WordPress plugin (versions ≤ 14.5.2 ) is vulnerable to an SQL Injection flaw due to improper neutralization of special elements used in SQL commands. This vulnerability allows an attacker to interfere with database queries. While the specific vulnerable component or function is not...

CVE-2026-111411

The Aman FunnelKit Automations WordPress plugin (versions

CVE-2026-111411 WordPress FunnelKit Automations plugin <= 3.8.5.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Blind SQL Injection.This issue affects FunnelKit Automations: from n/a through 3.8.5.2...

CVE-2026-111411 WordPress FunnelKit Automations plugin <= 3.8.5.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Blind SQL Injection.This issue affects FunnelKit Automations: from n/a through 3.8.5.2...

EUVD-2026-112065

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Blind SQL Injection.This issue affects FunnelKit Automations: from n/a through 3.8.5.2...

CVE-2026-115607

The DXP ToolKit WordPress plugin (versions up to and including 2.0.1 ) is vulnerable to an SQL Injection flaw caused by improper neutralization of special elements in SQL commands. This vulnerability allows an attacker to execute unauthorized SQL queries, potentially leading to high confidentiali...

EUVD-2026-112064

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Crowd Favorite DXP ToolKit dxp-toolkit allows SQL Injection.This issue affects DXP ToolKit: from n/a through 2.0.1...