PT-2026-108909

ProcessMaker is an open source workflow management software suite. Prior to 2026.14.3, the GET /api/1.0/tasks endpoint in ProcessMaker is vulnerable to SQL injection through the order by parameter because ProcessMakerTraitsTaskControllerIndexMethods::applyColumnOrdering concatenates a...

PT-2026-108843

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Taskbuilder Taskbuilder taskbuilder allows Blind SQL Injection.This issue affects Taskbuilder: from n/a through 6.0.5...

PT-2026-108865

Name of the Vulnerable Software and Affected Versions EduAdmin Booking versions prior to 6.0.0 Description An issue exists where improper neutralization of special elements used in an SQL command allows for Blind SQL Injection. Blind SQL Injection is a technique that allows an attacker to infer...

PT-2026-109330

Name of the Vulnerable Software and Affected Versions JetBrains Exposed versions prior to 1.5.1 Description SQL injection is possible because several SQL functions accept raw string arguments that are not escaped or parameterized. This allows crafted input to break out of the query context and...

PT-2026-108819

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through 3.2.9...

CVE-2026-94663: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Blind SQL Injection.This issue affects ProfileGrid: from n/a through 6.0.0.2...

WordPress WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars plugin < 4.1.0 - Authenticated (Contributor+) SQL Injection vulnerability

Authenticated Contributor+ SQL Injection vulnerability discovered by Joshua Martinelle in WordPress Plugin WP Post Author versions 4.1.0...

CVE-2026-96331: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in wpdreams Ajax Search Pro ajax-search-pro allows Blind SQL Injection.This issue affects Ajax Search Pro: from n/a through 4.29.1...

PT-2026-108873

Name of the Vulnerable Software and Affected Versions Testimonials by BestWebSoft WordPress plugin versions prior to 1.0.9 Description An issue exists where a parameter is not properly sanitized and escaped before being used in a SQL query. This allows unauthenticated attackers to perform SQL...

Drupal 7.31 SQL Injection

Drupal version 7.31 contains an unauthenticated SQL injection vulnerability in array-placeholder construction. The supplied proof of concept sends a crafted login field to demonstrate SQL injection. https://packetstorm.news/download/235021...

CVE-2026-96809: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in MultiNet Interactive AB EduAdmin Booking eduadmin-booking allows Blind SQL Injection.This issue affects EduAdmin Booking: from n/a before 6.0.0...

PT-2026-108849

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in jegtheme JNews - Pay Writer jnews-pay-writer allows Blind SQL Injection.This issue affects JNews - Pay Writer: from n/a through 12.0.1...

CVE-2026-108124: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in wp-post-author. This issue affects wp-post-author before 4.1.0...

PT-2026-108844

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in VibeThemes WPLMS wplms allows Blind SQL Injection.This issue affects WPLMS : from n/a through 4.973...

WordPress WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars plugin < 4.1.0 - Authenticated (Admin+) SQL Injection vulnerability

Authenticated Admin+ SQL Injection vulnerability discovered by Joshua Martinelle in WordPress Plugin WP Post Author versions 4.1.0...

CVE-2026-96327: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in VibeThemes WPLMS wplmsplugin allows Blind SQL Injection.This issue affects WPLMS: from n/a before 1.9.9.8.2...

CVE-2026-108125: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in wp-post-author. This issue affects wp-post-author version 4.0.0 prior to 4.1.0...

PT-2026-108942

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in wp-post-author. This issue affects wp-post-author version 4.0.0 prior to 4.1.0...

Django 4.0.5 Trunc SQL Injection

Django version 4.0.5 contains a SQL injection vulnerability in the Trunc and Extract database functions when user-controlled date units are inserted into generated SQL without escaping. Includes a proof of concept vulnerable environment. https://packetstorm.news/download/235022...

PT-2026-108832

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Blind SQL Injection.This issue affects ProfileGrid: from n/a through 6.0.0.2...