265569 matches found
Fedora 44 : wordpress (2026-5ada1f2961)
The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-5ada1f2961 advisory. WordPress 6.9.10 Security Release Security updates included in this release - A stored XSS on the Comments administration page, exploitable via pending...
Security Updates for Microsoft Endpoint Configuration Manager (October 2026)
The Microsoft Endpoint Configuration Manager installed on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Improper neutralization of special elements used in an sql command 'sql injection' in Microsoft Configuration Manager allows an authoriz...
Fedora 43 : wordpress (2026-e0ebe50146)
The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-e0ebe50146 advisory. WordPress 6.9.10 Security Release Security updates included in this release - A stored XSS on the Comments administration page, exploitable via pending...
VulnCheck KEV: CVE-2026-97668
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart persistent metavalue in all versions up to, and including, 10.8.0 due to insufficient escaping on user supplied data and lack of sufficient preparation on the existing SQL query in the...
Red Hat: CVE-2026-86047: mariadb: mariadb: SQL injection via improper identifier quoting
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A...
CVE-2026-64959: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection', Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly...
PT-2026-115521
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in halfdata Green Popups halfdata-green-popups allows Blind SQL Injection.This issue affects Green Popups: from n/a before 7.6.3...
PT-2026-115906
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, text-protocol escaping always prefixes quotes with a backslash and does not honor the session's NO BACKSLASH ESCAPES mode, including in...
PT-2026-115481
Name of the Vulnerable Software and Affected Versions WX Subscribe 微信支付付费订阅 WordPress plugin versions prior to 1.2.2 Description An issue exists where a parameter is not properly sanitized and escaped before being used in a SQL statement. This allows unauthenticated attackers to perform SQL...
CVE-2026-111718: Improper Neutralization of Special Elements used in an SQL Command
AipexBase through commit 690adb9 contains a sql injection vulnerability that allows attackers to inject SQL through the orderby and groupby fields of the /api/data/invoke endpoint. Attackers can supply subqueries or EXTRACTVALUE and UPDATEXML functions that bypass the SqlGuard denylist and...
CVE-2026-55796: Improper Neutralization of Special Elements used in an SQL Command
Frappe HR is an open-source human resources management solution HRMS. Prior to 15.60.3 and 16.7.1, the Salary Payments via ECS report constructs report conditions with unsafe SQL string interpolation. An authenticated HR user supplies crafted Salary Payments via ECS report filter values. The...
PT-2026-116085
IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL through the num path parameter of /WebArticle/findarticlesbynum. Attackers can append crafted SQL after the LIMIT clause concatenated into a MyBatis-Plus QueryWrapper to extract...
CVE-2026-86047: Improper Neutralization of Special Elements used in an SQL Command
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A...
PT-2026-116117
AipexBase through commit 690adb9 contains a sql injection vulnerability that allows attackers to inject SQL through the order by and group by fields of the /api/data/invoke endpoint. Attackers can supply subqueries or EXTRACTVALUE and UPDATEXML functions that bypass the SqlGuard denylist and...
PT-2026-115595
Name of the Vulnerable Software and Affected Versions MapSVG versions prior to 8.16.2 Description An SQL Injection issue exists in the MapSVG mapsvg-lite-interactive-vector-maps component. This occurs due to the improper neutralization of special elements used in an SQL command, which allows an...
PT-2026-115917
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.0 until 3.2.5, 3.3.4, 3.4.7, and 3.5.4, applications that enable permitSetMultiParamEntries can pass objects whose keys are expanded into a SQL SET clause without being processe...
PT-2026-115905
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.0 until 3.2.5, 3.3.4, 3.4.7, and 3.5.4, applications that enable permitSetMultiParamEntries can pass objects whose keys are expanded into a SQL SET clause without being processe...
PT-2026-115437
The Mail Mint plugin for WordPress is vulnerable to SQL Injection via the 'filters' parameter of the /wp-json/mrm/v1/segments/contacts REST endpoint in versions up to, and including, 1.31.4 This is due to insufficient escaping on the user supplied filter 'value' before it is appended to a SQL que...
PT-2026-115666
PeerBanHelper automatically blocks unwanted, leeching, and abnormal BitTorrent peers using customizable and cloud rules. From 5.0.0 until 9.3.15, the /api/statistic/analysis/field endpoint accepts a crafted field query parameter from an authenticated user and passes it to countField or sumField...
CVE-2026-62362: Improper Neutralization of Special Elements used in an SQL Command
PeerBanHelper automatically blocks unwanted, leeching, and abnormal BitTorrent peers using customizable and cloud rules. From 5.0.0 until 9.3.15, the /api/statistic/analysis/field endpoint accepts a crafted field query parameter from an authenticated user and passes it to countField or sumField...