Kishan Lal Hospital Management System: Input validation error vulnerability

The Kishan Lal Hospital Management System has a security vulnerability. This vulnerability stems from the incorrect handling of the parameter ID in the mysqliquery function of the Appointment Cancellation Handler component, which may lead to SQL injection...

Ravi Teja Online-Examination-System Input Verification Error Vulnerability

Ravi Teja Online-Examination-System has a security vulnerability. This vulnerability stems from the improper handling of parameters in the exammanger.php file within the AJAX Endpoint component’s MySQLDB::topicslist function. It may lead to SQL injection attacks...

nemoTyrant manong input validation error vulnerability

nemoTyrant manong has a security vulnerability. This vulnerability stems from operational issues with the functions cache/delcache/arr2sql in the func.php file. It may lead to SQL injection attacks, and attackers could launch attacks remotely...

Ravi Teja Online-Examination-System Input Verification Vulnerability

Ravi Teja Online-Examination-System has a security vulnerability. This vulnerability stems from the incorrect handling of the topicid parameter in the Exam::startExam function within the exam.php file in the Exam Module component. This could lead to SQL injection attacks, and attackers could...

CLSA-2026-1792238249 dovecot: Fix of 5 CVEs

CVE-2026-40018: fail MySQL string escaping and SQL passdb lookups while not connected instead of escaping without the connection charset; SQL userdb lookups and dict-sql updates also fail temporarily while not connected...

Exploit for SQL Injection in Apache Log4J

CVE-2022-23305 Lab nghiên cứu, pin Apache Log4j 1.2.17 và JD...

portswigger-labs-writeups

PortSwigger Labs — Write-ups & Solutions Personal write-up re...

CVE-2026-104122

The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQL query, allowing users with Contributor-level access and above to perform SQL injection attacks...

CVE-2026-91074

The BSK PDF Manager WordPress plugin through 3.8.1 does not properly sanitise and escape a parameter before using it in a SQL statement, which could allow authenticated users with contributor-level access and above to perform SQL injection attacks and read sensitive data such as administrator...

EUVD-2026-103254

The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQL query, allowing users with Contributor-level access and above to perform SQL injection attacks...

CVE-2026-104122 Ukr-To-Lat <= 1.3.5 - Contributor+ SQLi via Term Name

The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQL query, allowing users with Contributor-level access and above to perform SQL injection attacks...

CVE-2026-104122

The Ukr-To-Lat WordPress plugin, in versions through 1.3.5 , is vulnerable to SQL injection due to a failure to sanitize and escape a term name before utilizing it in a SQL query. This flaw allows users with Contributor-level access and above to execute unauthorized SQL commands. No specific reme...

CVE-2026-104122 Ukr-To-Lat <= 1.3.5 - Contributor+ SQLi via Term Name

The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQL query, allowing users with Contributor-level access and above to perform SQL injection attacks...

EUVD-2026-103249

The BSK PDF Manager WordPress plugin through 3.8.1 does not properly sanitise and escape a parameter before using it in a SQL statement, which could allow authenticated users with contributor-level access and above to perform SQL injection attacks and read sensitive data such as administrator...

CVE-2026-91074 BSK PDF Manager <= 3.8.1 - Contributor+ SQLi via tags_specific Shortcode Attribute

The BSK PDF Manager WordPress plugin through 3.8.1 does not properly sanitise and escape a parameter before using it in a SQL statement, which could allow authenticated users with contributor-level access and above to perform SQL injection attacks and read sensitive data such as administrator...

CVE-2026-91074 BSK PDF Manager <= 3.8.1 - Contributor+ SQLi via tags_specific Shortcode Attribute

The BSK PDF Manager WordPress plugin through 3.8.1 does not properly sanitise and escape a parameter before using it in a SQL statement, which could allow authenticated users with contributor-level access and above to perform SQL injection attacks and read sensitive data such as administrator...

CVE-2026-91074

The BSK PDF Manager WordPress plugin affects versions through 3.8.1 due to improper sanitization and escaping of a parameter within a SQL statement. This vulnerability specifically impacts the tags_specific shortcode attribute. Authenticated users with contributor-level access and above can explo...

CVE-2026-107752

The Welcart e-Commerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wpuscesorderold JSON fields searchSql / searchSkuSql' parameter in all versions up to, and including, 2.12.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation o...

CVE-2026-107752

The Welcart e-Commerce plugin for WordPress is vulnerable to SQL Injection in versions up to and including 2.12.4 . The root cause is insufficient escaping on the user-supplied 'wp_usces_order_old' cookie (specifically the searchSql and searchSkuSql JSON fields) and a lack of sufficient preparati...

EUVD-2026-103221

The Welcart e-Commerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wpuscesorderold JSON fields searchSql / searchSkuSql' parameter in all versions up to, and including, 2.12.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation o...