CVE-2026-90724: Dell PowerProtect Data Domain Management Center: Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions…

Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special...

CVE-2026-115607: Crowd Favorite DXP ToolKit: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crowd Favorite…

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Crowd Favorite DXP ToolKit dxp-toolkit allows SQL Injection.This issue affects DXP ToolKit: from n/a through 2.0.1...

CVE-2026-116750: e4jvikwp VikRentCar Car Rental Management System: The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to blind SQL Injection via the 'catid'…

The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to blind SQL Injection via the 'catid' parameter in all versions up to, and including, 1.4.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...

Tabularis SQL injection vulnerability

Versions Tabularis from 0.10.0 up to but not including 0.28.0 contain an SQL injection vulnerability. This vulnerability stems from improper handling of the special tablename parameter by the describetable tool within the SQLite driver. It makes the system susceptible to SQL injection attacks;...

OpenCATS input validation error vulnerability

Versions prior to OpenCATS 0.10.0 contain a security vulnerability. This vulnerability stems from insufficient validation or escaping of the period, startDate, and endDate parameters in the activity DataGrid date filtering within modules/home/dataGrids.php and modules/activity/dataGrids.php. Thes...

PT-2026-130625

Name of the Vulnerable Software and Affected Versions SendPress Newsletters versions prior to 1.26.1.21 Description An issue exists where unauthenticated attackers can perform time-based SQL Injection, a technique used to infer data from a database by observing the time it takes for the server to...

VulnCheck KEV: CVE-2026-27413

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Cozmoslabs Profile Builder Pro allows Blind SQL Injection.This issue affects Profile Builder Pro: from n/a before 3.14.0...

CVE-2026-118378: TabularisDB tabularis: Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute…

Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stacked statements by supplying a crafted tablename to the describetable tool. Attackers, including AI agents steered by untrusted content, can close the quoted PRAGMA argument...

VICIdial 2.14-917a Blind SQL Injection

VICIdial version 2.14-917a contains an unauthenticated time-based SQL injection vulnerability in VERMAJAXfunctions.php. The proof of concept sends crafted Basic Authentication requests to confirm the issue and extract database metadata or limited table data. https://packetstorm.news/download/2380...

Futurum Software User Authentication Module SQL injection vulnerability

Versions of the Futurum Software User Authentication Module prior to May 2026 contain an SQL injection vulnerability. This vulnerability stems from insufficient validation and sanitization of user-supplied input, as well as improper WAF configuration. It may allow unauthenticated attackers to...

CVE-2026-90723: Dell PowerProtect Data Domain Management Center: Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions…

Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special...

PT-2026-127817

The Thrive Automator WordPress plugin before 11.2 does not properly sanitize and escape a parameter's array key before using it in a SQL query, allowing authenticated attackers with editor-level access to perform blind SQL injection attacks...

PT-2026-128233

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in BuddyPress BuddyPress buddypress allows SQL Injection.This issue affects BuddyPress: from n/a through 14.5.2...

PT-2026-127899

Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special...

PT-2026-128052

Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special...

WordPress FunnelKit Automations SQL injection vulnerability

WordPress FunnelKit Automations versions 3.8.5.2 and earlier contain an SQL injection vulnerability. This vulnerability stems from improper handling of special elements within SQL commands, potentially leading to blind SQL injection...

Dell PowerProtect Data Domain Management Center SQL injection vulnerability

SQL injection vulnerabilities exist in Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8, 7.13.1.0 through 7.13.1.80, 8.3.1.0 through 8.3.1.40, and 8.6.1.0 through 8.6.1.20. These vulnerabilities stem from improper handling of special elements within SQL commands, makin...

WordPress DXP ToolKit SQL injection vulnerability

WordPress DXP ToolKit versions 2.0.1 and earlier contain an SQL injection vulnerability. This vulnerability stems from improper handling of special elements within SQL commands, potentially leading to SQL injection attacks...

CVE-2026-116609: osamaesh WP Visitor Statistics (Real Time Traffic): The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to SQL Injection via the 'from' (and…

The WP Visitor Statistics Real Time Traffic plugin for WordPress is vulnerable to SQL Injection via the 'from' and sibling 'to'/'first'/'second' shortcode attribute of the wsmshowTrafficStatsList shortcode in versions up to, and including, 8.8 This is due to insufficient escaping on the...

CVE-2026-115224: Unknown Customer Engagement System: The Customer Engagement System WordPress plugin before 2.0.2 does not safely build the SQL statements that store a…

The Customer Engagement System WordPress plugin before 2.0.2 does not safely build the SQL statements that store a popup's page and category visibility rules, concatenating request-supplied ID values directly into an INSERT statement with no parameter binding or integer cast, allowing an...