265394 matches found
CVE-2026-115281: Unknown Recipe Card Blocks Lite: The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize and cast a block and shortcode attribute…
The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize and cast a block and shortcode attribute before concatenating it into SQL queries, allowing authenticated users with Contributor-level access or above to perform SQL injection attacks...
CVE-2026-111850: BuddyPress: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyPress…
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in BuddyPress BuddyPress buddypress allows SQL Injection.This issue affects BuddyPress: from n/a through 14.5.2...
CVE-2026-104694: Unknown Thrive Automator: The Thrive Automator WordPress plugin before 11.2 does not properly sanitize and escape a parameter's array key before…
The Thrive Automator WordPress plugin before 11.2 does not properly sanitize and escape a parameter's array key before using it in a SQL query, allowing authenticated attackers with editor-level access to perform blind SQL injection attacks...
CVE-2026-111411: Aman FunnelKit Automations: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman FunnelKit…
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Blind SQL Injection.This issue affects FunnelKit Automations: from n/a through 3.8.5.2...
CVE-2026-86401: Dell PowerProtect Data Domain Management Center: Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions…
Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special...
CVE-2026-90719: Dell PowerProtect Data Domain Management Center: Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions…
Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special...
CVE-2026-76005: chuck1982 WP Inventory Manager: The WP Inventory Manager plugin for WordPress is vulnerable to time-based SQL Injection via 'sort_order' Shortcode…
The WP Inventory Manager plugin for WordPress is vulnerable to time-based SQL Injection via 'sortorder' Shortcode Attribute in all versions up to, and including, 2.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...
CVE-2026-61569: WWBN AVideo-Encoder: AVideo is a video-sharing Platform
AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated streamer login at objects/login.json.php passes the user parameter to Streamer::get in objects/Streamer.php, where it is interpolated into a single-quoted MariaDB SELECT without parameterization or escaping. Although...
WordPress WP Inventory Manager SQL injection vulnerability
WordPress WP Inventory Manager versions 2.5.5 and earlier contain an SQL injection vulnerability. This vulnerability stems from a time-based SQL injection flaw in the sortorder shortcode. Due to insufficient sanitization and escaping of user-supplied parameters, as well as inadequate preparation ...
CVE-2026-61564: WWBN AVideo-Encoder: AVideo is a video-sharing Platform
AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint install/checkConfiguration.php assembles videos/configuration.php by interpolating request parameters, including webSiteRootURL, into single-quoted PHP string literals without escaping. An attacker can...
CVE-2026-103792: Dell PowerProtect Data Domain Management Center: Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions…
Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special...
PT-2026-130626
Name of the Vulnerable Software and Affected Versions The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress versions prior to 4.1.13 Description An issue exists where unauthenticated attackers can perform SQL Injection by appending additional queries to...
WordPress Business Directory 6.4.2 SQL Injection
WordPress Business Directory plugin version 6.4.2 contains an unauthenticated time-based SQL injection vulnerability through the listingfields parameter. The supplied proof of concept demonstrates the affected search request. https://packetstorm.news/download/238011...
PT-2026-127883
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to blind SQL Injection via the 'catid' parameter in all versions up to, and including, 1.4.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...
Linux Distros Unpatched Vulnerability : CVE-2026-116218
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the...
CVE-2026-57190 Asterisk: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the PostgreSQL and TDS/MSSQL Channel Event Log backends celpgsql and celtds may permit arbitrary SQL execution when untrust...
CVE-2026-57190 Asterisk: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the PostgreSQL and TDS/MSSQL Channel Event Log backends celpgsql and celtds may permit arbitrary SQL execution when untrust...
CVE-2026-57190
Asterisk, an open source telephony toolkit, contains an SQL Injection vulnerability in the cel_pgsql and cel_tds Channel Event Log backends. The issue occurs when the CELGenUserEvent dialplan application passes untrusted data into the CEL eventtype column. An attacker could achieve arbitrary SQL ...
CVE-2026-57190 Asterisk: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the PostgreSQL and TDS/MSSQL Channel Event Log backends celpgsql and celtds may permit arbitrary SQL execution when untrust...
