WordPress Vitepos SQL Injection Vulnerability

WordPress Vitepos 3.6.1 and earlier versions have a SQL injection vulnerability. This vulnerability stems from improper cleaning of user input for the parameters srcby.val.start / srcby.val.end operator 'bt', and insufficient preparation of existing SQL queries. This leads to blind SQL injections...

The cosy icecms SQL injection vulnerability

The thecosy icecms versions 4.1.5 and earlier have a SQL injection vulnerability. This vulnerability stems from unvalidated SQL injections. Attackers can append additional SQL statements after the LIMIT clause in the QueryWrapper.last method by providing specially crafted inputs to the num...

Helicalinsight SQL injection vulnerability

Helicalinsight versions 7.0.0 and earlier have a SQL injection vulnerability. This vulnerability arises from report parameter values sent to /executeDatasource that are not properly escaped. Attackers can use custom Numeric or String placeholder values to bypass the ineffective SqlDetect...

Frappe HR SQL Injection Vulnerability

Versions of Frappe HR prior to 15.60.3 and from 16.0.0 to 16.7.1 have a SQL injection vulnerability. This vulnerability arises from the use of insecure SQL string interpolation in the Salary Payments via ECS report, which allows authenticated HR users to inject SQL statements through report filte...

Frappe HR SQL Injection Vulnerability

Versions of Frappe before 14.38.2, as well as versions before 14.x before 15.64.0, 15.x before 16.18.0, and 16.x before 16.18.0 have a SQL injection vulnerability. This vulnerability stems from the lack of input validation on certain endpoints, which may lead to SQL injections. Any authenticated...

The cosy icecms SQL injection vulnerability

The thecosy icecms 4.1.5 and earlier versions have a SQL injection vulnerability. This vulnerability arises from the lack of validation for the num path parameter in the /WebArticle/findarticlesbynum route. This makes the system vulnerable to SQL injection attacks. A remote attacker can append...

WHEELS.DEV: Wheels SQL injection vulnerability

WHEELS.DEV: Versions of Wheels 4.1.2 and earlier have an SQL injection vulnerability. This vulnerability occurs in MySQL/MariaDB environments where escape characters are enabled. When the application provides request data to inline literal paths, it does not consider escape characters and simply...

WordPress Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance plugin <= 1.31.4 - Authenticated (Custom+) SQL Injection vulnerability

Authenticated Custom+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Mail Mint versions = 1.31.4...

Astra Linux – Vulnerability in Apache Log4j1.2

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter, where the values to be inserted are converted using PatternLayout. The message converter %m is likely to always be included. This allows attackers to manipulate SQL statements by entering crafted...

Astra Linux – vulnerability in PostgreSQL 11

In the extension script, a SQL injection vulnerability was found in PostgreSQL when it uses @extowner@, @extschema@, or @extschema:...@ within a quoting construct dollar quoting, '', or "". If an administrator has installed files from a vulnerable, trusted, non-bundled extension, an attacker with...

Astra Linux – Vulnerability in PostgresSQL 11

When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries during the initial establishment of a connection, despite the use of SSL certificate verification and encryption...

Astra Linux – Vulnerability in OpenLDAP

In OpenLDAP 2.x versions before 2.5.12 and 2.6.x versions before 2.6.2, there is a SQL injection vulnerability in the experimental slapd backend, caused by a SQL statement within an LDAP query. This vulnerability can occur during an LDAP search operation, when the search filter is processed, due ...

Astra Linux – vulnerability in libhibernate3-java

A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. An SQL injection in the implementation of the JPA Criteria API can allow un sanitized literals to be used when a literal appears in the SQL comments of a query. This flaw may enable an attacker to access...

Astra Linux – vulnerability in libpgjava

The PostgreSQL JDBC Driver abbreviated as PgJDBC enables Java programs to connect to a PostgreSQL database using standard, database-independent Java code. The PGJDBC implementation of the java.sql.ResultRow.refreshRow method fails to escape column names; therefore, a malicious column name...

WordPress FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin <= 1.7.0 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin FluentCart versions = 1.7.0...

CVE-2026-53574

EspoCRM is an open source customer relationship management application. From 8.1.0 until 9.3.8, an authenticated non-administrator can submit a crafted where parameter to the GET entity streamAttachments endpoint because that query path permits complex expressions. Boolean-based blind SQL injecti...

600,000 WordPress Sites Affected by SQL Injection Vulnerability in Backuply WordPress Plugin

On September 17th, 2026, we received a submission for a Second-Order SQL Injection vulnerability in Backuply, a WordPress plugin with more than 600,000 active installations. This vulnerability makes it possible for authenticated attackers with subscriber-level access and above to store a maliciou...

mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string()

A flaw was found in MariaDB server. An application processing non-validated user input, which then uses mysqlrealescapestring and sends data to the database via text protocol with the big5 character set, is vulnerable to SQL injection. This allows a remote attacker to execute malicious SQL...

Important: Red Hat Security Advisory: mariadb-connector-c security update

An update for mariadb-connector-c is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

CVE-2026-53574

The open-source customer relationship management application EspoCRM is vulnerable to a boolean-based blind SQL injection in versions 8.1.0 through 9.3.8 . The flaw exists in the GET entity streamAttachments endpoint because the query path permits complex expressions, allowing an authenticated no...