PT-2026-110059

Name of the Vulnerable Software and Affected Versions Datalist it versions prior to 0.0.4 Description The Datalist it WordPress plugin fails to sanitize and escape several request parameters used in the construction of SQL queries. This allows unauthenticated attackers to execute SQL injection...

CVE-2026-89214: Improper Neutralization of Special Elements used in an SQL Command

The WpCues Basic Quiz WordPress plugin through 1.6.5 does not properly sanitise and escape values before using them in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database...

PT-2026-110103

Name of the Vulnerable Software and Affected Versions Xinhu Rainrock RockOA versions prior to 2.7.7 Description A remote SQL injection exists within the Openkqj Action component. The issue occurs in the kqjcmdModel::returnchuli function located in the webmain/task/openapi/openkqjAction.php file. ...

CVE-2026-89195: Improper Neutralization of Special Elements used in an SQL Command

The Site Setup Wizard WordPress plugin through 1.5.8 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database...

PT-2026-110052

Name of the Vulnerable Software and Affected Versions Social Web Suite versions prior to 4.1.13 Description The Social Web Suite WordPress plugin fails to require a shared secret before accepting authorized requests. Additionally, it does not sanitize or escape a parameter used in an SQL statemen...

PT-2026-110010

Name of the Vulnerable Software and Affected Versions Mobile builder WordPress plugin versions prior to 1.4.3 Description Unauthenticated users can perform SQL injection attacks because the plugin fails to sanitize and escape a parameter before incorporating it into a SQL statement. SQL injection...

PT-2026-110071

Name of the Vulnerable Software and Affected Versions highwarden Super Store Finder versions prior to 3.9 Description An issue exists in the /products/superstorefinder/index.php file where manipulation of the lat/lng argument allows for SQL injection, a technique used to interfere with the querie...

CVE-2026-59508: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Interuse i-Bos. This issue affects i-Bos: 3.0...

CVE-2026-108773: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in erzhongxmu JEEWMS up to 2026.09.27-W39. Impacted is the function docheck of the file src/main/java/com/zzjee/wm/controller/WmOmNoticeHController.java. Performing a manipulation of the argument goodscode results in sql injection. The attack may be initiated remotely...

CVE-2026-108571: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6. This impacts the function kqjcmdModel::returnchuli of the file webmain/task/openapi/openkqjAction.php of the component Openkqj Action. This manipulation of the argument ID causes sql injection. The attack is possible to be carri...

FreeBSD : py-WsgiDAV -- Multiple vulnerabilities (0f5aaca7-c4d5-11f1-96b4-74563cf85f9d)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 0f5aaca7-c4d5-11f1-96b4-74563cf85f9d advisory. [email protected] reports: WsgiDAV is a generic and extendable WebDAV server based on WSGI. WsgiDA...

CVE-2026-89232: Improper Neutralization of Special Elements used in an SQL Command

The Recordbrowser WordPress plugin through 1.1.7 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database...

PT-2026-110353

Name of the Vulnerable Software and Affected Versions erzhongxmu JEEWMS versions prior to 2026.09.27-W39 Description A remote SQL injection exists due to improper handling of the searchstr argument within the WvGiController.list function. SQL injection is a technique where an attacker inserts...

CVE-2026-89287: Improper Neutralization of Special Elements used in an SQL Command

The ASPL Product Quotation WordPress plugin through 1.1.0 does not sanitize and escape a parameter before using it in SQL statements, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database...

PT-2026-110065

Name of the Vulnerable Software and Affected Versions paymendo WordPress plugin versions prior to 1.2 Description The plugin fails to properly sanitize and escape the orderBy parameter before incorporating it into a SQL query. This flaw allows authenticated users to execute SQL injection attacks,...

PT-2026-110053

Name of the Vulnerable Software and Affected Versions Site Setup Wizard versions prior to 1.5.9 Description An issue exists where the plugin fails to properly sanitize and escape a parameter before incorporating it into a SQL statement. This allows unauthenticated attackers to execute SQL injecti...

PT-2026-110187

Name of the Vulnerable Software and Affected Versions erzhongxmu Jeewms versions prior to 3.7 Description A remote SQL injection issue exists within the Autocomplete Data Handler component. The flaw is located in the getTreeData function of the...

CVE-2026-108684: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in erzhongxmu Jeewms up to 3.7. This affects the function getTreeData of the file src/main/java/com/jeecg/demo/controller/JeecgFormDemoController.java of the component Autocomplete Data Handler. Performing a manipulation of the argument searchVal results in sql...

FreePBX Endpoint Manager 17.0.2 Unauthenticated SQL Injection

FreePBX Endpoint Manager versions prior to 15.0.66, 16.0.89, and 17.0.3 contain an unauthenticated SQL injection that allows database modification and remote command execution through scheduled jobs. https://packetstorm.news/download/235109...

PT-2026-110061

Name of the Vulnerable Software and Affected Versions Loja Automática versions prior to 1.0.1 Description Unauthenticated users can perform SQL injection attacks because the plugin fails to properly sanitize and escape the id parameter before incorporating it into a SQL query. SQL injection is a...