EUVD-2026-118028

SQL injection vulnerability in Atmira’s SIREC. The server retrieves the value of a field from a JSON object containing user-supplied information and concatenates it into an SQL statement without properly sanitising the input. This allows the original query to be altered via malicious input, causi...

CVE-2022-37205

CVE-2022-37205 CVE-2022-37205 POC Suggested description RESERVED JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection. Additional Information...

CVE-2022-21661-Technical-Analysis

Overview of CVE-2022-21661 CVE-2022-21661 is a SQL injection vulnerability found in WordPress, specifically affecting versions prior to 5.8.3. This vulnerability arises from improper sanitization in the WPQuery class, which is used for custom database queries. its classic SQL injection...

FreePBX-CVE-2025-57819-CVE-2025-61678

FreePBX-CVE-2025-57819-CVE-2025-61678 Chains CVE-2025-57819 stacked query SQL injection and CVE-2025-61678 authenticated file upload in FreePBX Endpoint Manager to achieve Remote Code Execution RCE. For educational use only. References:...

CVE-2026-88985

A flaw was found in Kubeflow Pipelines, which can lead to information disclosure. An authenticated remote attacker with permissions to list pipelines or runs can exploit this vulnerability by submitting a crafted pagination token containing manipulated database query fields. Because the API serve...

CVE-2025-4840

CVE-2025-4840 Likes and Dislikes Plugin = 1.0.0 - Unauthenticated SQL Injection Description The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied...

CVE-2026-115997

A flaw was found in pig. The application fails to properly sanitize sorting parameters, leading to a Structured Query Language SQL injection vulnerability in the SQL filter argument resolver. A remote attacker could exploit this flaw by submitting specially crafted sorting requests to execute...

CVE-2023-32590

CVE-2023-32590 Subscribe to Category = 2.7.4 - Unauthenticated SQL Injection Description The Subscribe to Category plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.7.4 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-113615

The GS JWT Authentication for WP REST API WordPress plugin through 1.0.0 does not sanitize or parameterize a request value before using it in SQL queries on several unauthenticated REST routes, allowing unauthenticated attackers to perform SQL injection and obtain an administrator session...

CVE-2026-110532

The Mail Mage WordPress plugin through 0.0.25 does not properly sanitise and escape a user-supplied value before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks...

CVE-2026-113615

The GS JWT Authentication for WP REST API WordPress plugin (versions prepare() and ensure OTP checks are strictly validated. Proof of concept and exploitation details are available at https://github.com/thiscitze/cve-2026-113615-poc .

CVE-2026-113615 GS JWT Authentication <= 1.0.0 - Unauthenticated Privilege Escalation via SQLi

The GS JWT Authentication for WP REST API WordPress plugin through 1.0.0 does not sanitize or parameterize a request value before using it in SQL queries on several unauthenticated REST routes, allowing unauthenticated attackers to perform SQL injection and obtain an administrator session...

EUVD-2026-117910

The GS JWT Authentication for WP REST API WordPress plugin through 1.0.0 does not sanitize or parameterize a request value before using it in SQL queries on several unauthenticated REST routes, allowing unauthenticated attackers to perform SQL injection and obtain an administrator session...

EUVD-2026-117895

The Mail Mage WordPress plugin through 0.0.25 does not properly sanitise and escape a user-supplied value before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks...

CVE-2026-110532 Mail Mage <= 0.0.25 - Unauthenticated SQLi via 'ewp_unsubscribe' Parameter

The Mail Mage WordPress plugin through 0.0.25 does not properly sanitise and escape a user-supplied value before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks...

CVE-2026-110532

The Mail Mage WordPress plugin (versions

CVE-2021-42666

CVE-2021-42666 CVE-2021-42666 - SQL Injection vulnerability in the Engineers online portal system. Technical description: An SQL Injection vulnerability exists in the Engineers Online Portal system. An attacker can leverage the vulnerable "id" parameter in the "quizquestion.php" web page in order...

CVE-2016-10204_Webshell

CVE-2016-10204Webshell A bash script demonstrating the manual exploitation of CVE-2016-10204 against a target endpoint, leading to upload of a php webshell. Currently, the webshell variable is set for a MySQL payload. This can be replaced with whatever backend you need to target. More information...

CVE-2021-42668

cve-2021-42668 CVE-2021-42668 - SQL Injection vulnerability in the Engineers online portal system. Technical description: An SQL Injection vulnerability exists in the Engineers Online Portal. An attacker can leverage the vulnerable "id" parameter in the "myclassmates.php" web page in order to...

CVE-2026-113370

A flaw was found in Sonatype Nexus Repository. An authenticated user with task creation privileges can modify records in the underlying application database by exploiting a Structured Query Language SQL injection vulnerability. When the optional search reindexing task is enabled, an attacker can...