WordPress wpForo Forum plugin <= 3.2.2 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by UKO in WordPress Plugin wpForo Forum versions = 3.2.2...

CVE-2024-13483

CVE-2024-13483 LTL Freight Quotes – SAIA Edition = 2.2.10 - Unauthenticated SQL Injection Description The LTL Freight Quotes – SAIA Edition plugin for WordPress is vulnerable to SQL Injection via the 'editid' and 'dropshipeditid' parameters in all versions up to, and including, 2.2.10 due to...

WordPress Booking for Appointments and Events Calendar – Amelia Pro plugin 4.0-9.9.1 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by leon figueira in WordPress Plugin Amelia versions 4.0-9.9.1...

WordPress WebToffee WP Backup and Migration plugin <= 1.6.1 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by zickzick2 in WordPress Plugin WordPress Backup & Migration versions = 1.6.1...

hackazon

Hackazon Hackazon is a free, vulnerable test site that is an online storefront built with the same technologies used in today’s rich client and mobile applications. Hackazon has an AJAX interface, strict workflows and RESTful API’s used by a companion mobile app providing uniquely-effective...

ContentHistory

Joomla! 3.2 to 3.4.4 - SQL Injection expl.php Checker.pl alt tag joomlacontenthistorysqli.rb alt tag www.sec4ever.com...

cve-2024-37765

Description MachForm up to version 19 is affected by an authenticated Blind SQL injection in the user account settings page. SQL injection attacks consist in inserting SQL queries through the usage of an input data field from the client application. This kind of attack allows to obtain access to...

CVE-2024-51482

CVE-2024-51482 ZoneMinder v1.37. = 1.37.64 CVE-2024-51482 poc.py By default, this script enumerates the zm database, pulls from the Users table, and dumps Username+Password columns. If these 4 things exist, you will receive a username and password hash. More detailed information on the...

CVE-2026-54349 Chartbrew SQL injection in dashboard filter substitution

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.1, SQL dashboard-variable substitution used attacker-controlled JavaScript replacement strings unsafely across SQL connectors and separately failed to escape...

CVE-2026-54349

The open-source web application Chartbrew is vulnerable to SQL injection in versions prior to 5.2.1 . The issue exists within the applyMysqlOrPostgresVariables function, where SQL dashboard-variable substitution unsafely processes attacker-controlled JavaScript replacement strings across various ...

EUVD-2026-118501

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.1, SQL dashboard-variable substitution used attacker-controlled JavaScript replacement strings unsafely across SQL connectors and separately failed to escape...

Deep-Reaver

Deep Reaver Deep Reaver is a powerful, AI-enhanced vulnerability assessment and exploitation toolkit built in Python. Inspired by tools like Nmap and Nessus, Deep Reaver is designed for deep, modular scanning of web applications and services. Features AI-assisted analysis via aiassistant.py Modul...

WordPress WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin <= 5.5.90 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Daniel test in WordPress Plugin WP Data Access versions = 5.5.90...

CVE-2024-51482-POC

ZoneMinder Authenticated Time Based SQLi POC - CVE-2024-51482 ⚠️ For educational and authorized security research only. Running this tool against systems you do not own or lack written permission to test is illegal. Table of Contents ZoneMinder Authenticated Time Based SQLi POC - CVE-2024-51482...

CVE-2023-39361

Cacti graphview.php SQL Injection Leads to RCE CVE-2023-39361 WHS 3rd - Nam Gichan7342 ChoDeokCheol Summary A vulnerability exists in the growrightpanetree function of the graphview.php file in Cacti 1.2.24. When the action parameter is set to treecontent, the user-supplied rfilter parameter is...

listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials

Summary A SQL injection vulnerability in GET /api/subscribers/export allows an authenticated user with the subscribers:sqlquery permission to bypass the table access control that exists on the regular query endpoint GET /api/subscribers and read arbitrary tables from the database — including user...

GHSA-XGJR-7J9Q-2H4R listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials

Summary A SQL injection vulnerability in GET /api/subscribers/export allows an authenticated user with the subscribers:sqlquery permission to bypass the table access control that exists on the regular query endpoint GET /api/subscribers and read arbitrary tables from the database — including user...

CVE-2025-22785

CVE-2025-22785 Course Booking System = 6.0.5 - Unauthenticated SQL Injection Description The Course Booking System plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 6.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-123859

When identifier escaping is disabled through a non-default configuration, the writepandas data-loading functionality in the Snowflake Connector for Python and the Snowflake Connector for Python Universal Core did not escape DataFrame column names before including them in generated SQL, which coul...

WordPress Affiliate Program Suite — SliceWP Affiliates plugin <= 1.2.14 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Kuba in WordPress Plugin SliceWP versions = 1.2.14...