CVE-2026-91074 BSK PDF Manager <= 3.8.1 - Contributor+ SQLi via tags_specific Shortcode Attribute

The BSK PDF Manager WordPress plugin through 3.8.1 does not properly sanitise and escape a parameter before using it in a SQL statement, which could allow authenticated users with contributor-level access and above to perform SQL injection attacks and read sensitive data such as administrator...

CVE-2026-91074 BSK PDF Manager <= 3.8.1 - Contributor+ SQLi via tags_specific Shortcode Attribute

The BSK PDF Manager WordPress plugin through 3.8.1 does not properly sanitise and escape a parameter before using it in a SQL statement, which could allow authenticated users with contributor-level access and above to perform SQL injection attacks and read sensitive data such as administrator...

CVE-2026-91074

The BSK PDF Manager WordPress plugin affects versions through 3.8.1 due to improper sanitization and escaping of a parameter within a SQL statement. This vulnerability specifically impacts the tags_specific shortcode attribute. Authenticated users with contributor-level access and above can explo...

CVE-2026-107752

The Welcart e-Commerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wpuscesorderold JSON fields searchSql / searchSkuSql' parameter in all versions up to, and including, 2.12.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation o...

EUVD-2026-103221

The Welcart e-Commerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wpuscesorderold JSON fields searchSql / searchSkuSql' parameter in all versions up to, and including, 2.12.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation o...

CVE-2026-107752 Welcart e-Commerce <= 2.12.4 - Authenticated (Editor+) SQL Injection via 'wp_usces_order_old' Cookie

The Welcart e-Commerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wpuscesorderold JSON fields searchSql / searchSkuSql' parameter in all versions up to, and including, 2.12.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation o...

CVE-2026-107752

The Welcart e-Commerce plugin for WordPress is vulnerable to SQL Injection in versions up to and including 2.12.4 . The root cause is insufficient escaping on the user-supplied 'wp_usces_order_old' cookie (specifically the searchSql and searchSkuSql JSON fields) and a lack of sufficient preparati...

CVE-2026-107752 Welcart e-Commerce <= 2.12.4 - Authenticated (Editor+) SQL Injection via 'wp_usces_order_old' Cookie

The Welcart e-Commerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wpuscesorderold JSON fields searchSql / searchSkuSql' parameter in all versions up to, and including, 2.12.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation o...

Exploit for CVE-2026-107083

CVE-2026-107083 — SQL Injection via Unquoted Numeric Concatena...

pythonSQLInjection_Practica

Simulación y Mitigación de SQL Injection 1. Descripción de...

Exploit for CVE-2026-107082

CVE-2026-107082 — SQL Injection via opachide / promoted G...

PT-2026-116354

Name of the Vulnerable Software and Affected Versions Welcart e-Commerce versions prior to 2.12.5 Description The Welcart e-Commerce plugin for WordPress contains a SQL Injection flaw. Authenticated attackers with editor-level access or higher can append malicious SQL queries to existing ones due...

PT-2026-116373

Name of the Vulnerable Software and Affected Versions BSK PDF Manager versions prior to 3.8.2 Description Authenticated users with contributor-level access and above can perform SQL injection attacks due to improper sanitization and escaping of a parameter used in a SQL statement. This issue occu...

CVE-2026-91074: Improper Neutralization of Special Elements used in an SQL Command

The BSK PDF Manager WordPress plugin through 3.8.1 does not properly sanitise and escape a parameter before using it in a SQL statement, which could allow authenticated users with contributor-level access and above to perform SQL injection attacks and read sensitive data such as administrator...

Vedo Suite 1.2.5 SQL Injection

Vedo Suite version 1.2.5 contains an authenticated SQL injection issue in its chat API endpoint that may permit operating-system command execution through an enabled SQL Server xpcmdshell configuration...

CVE-2026-107752: Improper Neutralization of Special Elements used in an SQL Command

The Welcart e-Commerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wpuscesorderold JSON fields searchSql / searchSkuSql' parameter in all versions up to, and including, 2.12.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation o...

Apache Log4j 1.2.17 JDBCAppender SQL Injection

Apache Log4j version 1.2.17 JDBCAppender contains an SQL injection vulnerability when an unescaped logging message is embedded in a JDBCAppender SQL pattern. This package provides an isolated H2 proof of concept and whitebox data-flow report. https://packetstorm.news/download/236092...

SLiMS 9.8.0 SQL Injection

SLiMS version 9.8.0 contains SQL injection vulnerabilities in the serial control subscription and reporting detail administration modules. The supplied proof of concept demonstrates authenticated error-based database version disclosure through unquoted numeric parameters...

PT-2026-116367

Name of the Vulnerable Software and Affected Versions Ukr-To-Lat versions prior to 1.3.6 Description Users with Contributor-level access and above can perform SQL injection attacks because the plugin fails to sanitize and escape a term name before incorporating it into a SQL query. Recommendation...

PT-2026-116505

A weakness has been identified in nemoTyrant manong up to 7c9e5228e133b9267ad3a415833bc9bb53193bb4. This impacts the function cache/del cache/arr2sql of the file func.php. This manipulation causes sql injection. The attack may be initiated remotely. This product uses a rolling release model to...