World Wide Broadcast Network AVideo-Encoder code injection vulnerability

Versions prior to AVideo-Encoder 8.1.0 of the World Wide Broadcast Network contain a code injection vulnerability. This vulnerability arises because the unauthenticated installer endpoint install/checkConfiguration.php fails to escape request parameters when inserting them into single-quoted PHP...

Oracle E-Business Suite 12.2.15 TCF SQL Injection Scanner

Oracle E-Business Suite versions 12.2.3 through 12.2.15 contain an unauthenticated TCF SQL injection issue that can be chained to remote code execution. The supplied Nuclei template checks whether AppsTCFServer accepts the TCF proxy handshake...

Dell PowerProtect Data Domain Management Center SQL injection vulnerability

SQL injection vulnerabilities exist in Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8, 7.13.1.0 through 7.13.1.80, 8.3.1.0 through 8.3.1.40, and 8.6.1.0 through 8.6.1.20. These vulnerabilities stem from improper handling of special elements within SQL commands,...

Dell PowerProtect Data Domain Management Center SQL injection vulnerability

SQL injection vulnerabilities exist in Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8, 7.13.1.0 through 7.13.1.80, 8.3.1.0 through 8.3.1.40, and 8.6.1.0 through 8.6.1.20. These vulnerabilities stem from improper handling of special elements within SQL commands,...

PT-2026-128232

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Blind SQL Injection.This issue affects FunnelKit Automations: from n/a through 3.8.5.2...

PT-2026-127907

Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special...

PT-2026-129209

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, activity DataGrid date filtering in home:CallsDataGrid and activity:ActivityDataGrid uses request-controlled period, startDate and endDate parameters without...

PT-2026-127833

The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using it in a SQL query, and strips the escaping it had applied before running the query, allowing users with the Editor role or higher to perform SQL injection attacks...

PT-2026-127880

The WP Visitor Statistics Real Time Traffic plugin for WordPress is vulnerable to SQL Injection via the 'from' and sibling 'to'/'first'/'second' shortcode attribute of the wsm showTrafficStatsList shortcode in versions up to, and including, 8.8 This is due to insufficient escaping on the...

Dell PowerProtect Data Domain Management Center SQL injection vulnerability

SQL injection vulnerabilities exist in Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8, 7.13.1.0 through 7.13.1.80, 8.3.1.0 through 8.3.1.40, and 8.6.1.0 through 8.6.1.20. These vulnerabilities stem from improper handling of special elements within SQL commands,...

PT-2026-127910

A Blind SQL Injection vulnerability in Futurum Software’s management software, caused by a lack of adequate validation and sanitisation of user-provided inputs in queries to the private area’s database, as well as by an incorrect WAF configuration. This weakness allows the protection mechanisms t...

PT-2026-128087

Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special...

WordPress VikRentCar Car Rental Management System SQL injection vulnerability

WordPress VikRentCar Car Rental Management System versions 1.4.10 and earlier contain an SQL injection vulnerability. This vulnerability stems from insufficient escaping of the catid parameter and inadequate preparation for existing SQL queries; it is susceptible to blind SQL injection attacks. A...

PT-2026-127905

Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special...

Dell PowerProtect Data Domain Management Center SQL injection vulnerability

SQL injection vulnerabilities exist in Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8, 7.13.1.0 through 7.13.1.80, 8.3.1.0 through 8.3.1.40, and 8.6.1.0 through 8.6.1.20. These vulnerabilities stem from improper handling of special elements within SQL commands,...

Advanced Ads – Tracking SQL injection vulnerability

Advanced Ads – Versions prior to 4.0.0 contain an SQL injection vulnerability caused by improper handling of special elements within SQL commands; this may lead to blind SQL injection...

World Wide Broadcast Network AVideo-Encoder SQL injection vulnerability

Versions prior to AVideo-Encoder 8.1.0 of the World Wide Broadcast Network contain an SQL injection vulnerability. This vulnerability arises because unauthenticated streamers log user parameters without proper parameterization or escaping into MariaDB queries. As a result, attackers may exploit...

CVE-2026-90724: Dell PowerProtect Data Domain Management Center: Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions…

Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special...

CVE-2026-115607: Crowd Favorite DXP ToolKit: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crowd Favorite…

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Crowd Favorite DXP ToolKit dxp-toolkit allows SQL Injection.This issue affects DXP ToolKit: from n/a through 2.0.1...

CVE-2026-116750: e4jvikwp VikRentCar Car Rental Management System: The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to blind SQL Injection via the 'catid'…

The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to blind SQL Injection via the 'catid' parameter in all versions up to, and including, 1.4.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...