265985 matches found
CVE-2026-89299: Improper Neutralization of Special Elements used in an SQL Command
The WP Verify API WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...
CVE-2026-89304: Improper Neutralization of Special Elements used in an SQL Command
The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform blind SQL injection attacks...
RuoYi 4.8.3 SQL Injection
RuoYi versions 4.8.2 through 4.8.3 contain an SQL injection vulnerability in the code-generation createTable endpoint. The supplied proof of concept authenticates as an administrator and abuses a keyword-filter bypass to execute crafted CREATE TABLE AS SELECT statements...
Exploit for CVE-2026-102428
CVE-2026-102428 — OrdaSoft OS CCK comoscck unauthenticated...
CVE-2026-62117
Subscriber SQL Injection in Barcode Scanner with Inventory & Order Manager = 1.13.1 versions...
CVE-2026-62031
Unauthenticated SQL Injection in uListing = 2.2.0 versions...
CVE-2026-42722
Administrator SQL Injection in Frontend Admin by DynamiApps = 3.29.13 versions...
CVE-2026-45440
Administrator SQL Injection in WP Ultimate CSV Importer = 9.2 versions...
CVE-2026-42717
Administrator SQL Injection in Leyka = 3.32.3 versions...
CVE-2026-42712
Subscriber SQL Injection in Qode Tours = 3.1.3.2 versions...
CVE-2026-42633
Subscriber SQL Injection in Events Manager = 7.4.6 versions...
CVE-2026-40800
Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes = 1.5.3 versions...
CVE-2026-108604
Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP runquery safety gate that allows prompt-injected agents or untrusted MCP clients to bypass read-only mode by submitting side-effecting SELECT statements. Attackers can run statements like SELECT setval, nextval,...
CVE-2026-108604 Tabularis through 0.27.0 Read-Only Bypass via MCP run_query SELECT Classification
Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP runquery safety gate that allows prompt-injected agents or untrusted MCP clients to bypass read-only mode by submitting side-effecting SELECT statements. Attackers can run statements like SELECT setval, nextval,...
CVE-2026-62117
The WordPress Barcode Scanner with Inventory & Order Manager plugin (versions
EUVD-2026-96505
Subscriber SQL Injection in Barcode Scanner with Inventory & Order Manager = 1.13.1 versions...
CVE-2026-62117 WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - SQL Injection vulnerability
Subscriber SQL Injection in Barcode Scanner with Inventory & Order Manager = 1.13.1 versions...
CVE-2026-62117 WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - SQL Injection vulnerability
Subscriber SQL Injection in Barcode Scanner with Inventory & Order Manager = 1.13.1 versions...