CVE-2026-59526: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in MapSVG = 8.14.0 versions...

CVE-2026-61948: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in WPDM – Premium Packages = 6.2.0 versions...

PT-2026-64075

Summary The FileCatalog DatasetManager runs a query on the database and passes the result to eval. The SQL query contains an injection vulnerability which allows an authenticated user to control the parameter returned to the eval resulting in remote code execution. Details The FileCatalog...

CVE-2026-65462: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in Uncanny Automator = 7.3.2 versions...

Debian dsa-6399 : wordpress - security update

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6399 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6399-1 [email protected] https://www.debian.org/security/...

PT-2026-63598

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing...

PT-2026-64032

Name of the Vulnerable Software and Affected Versions Easy Store versions 1.0.0 through 2.0.1 Description Improper validation of order parameters allows an unauthenticated SQL injection, which is a technique used to manipulate database queries. This issue enables full read access to the database,...

PT-2026-63849

Unauthenticated SQL Injection in Participants Database = 2.7.8.3 versions...

PT-2026-63866

Unauthenticated SQL Injection in TrueBooker = 1.2.3 versions...

CVE-2026-59514: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Buddyboss Platform = 3.0.5 versions...

PT-2026-63805

Contributor SQL Injection in eRoom = 1.7.1 versions...

PT-2026-63865

Unauthenticated SQL Injection in Bookly = 27.7 versions...

CVE-2026-63359: Improper Neutralization of Special Elements used in an SQL Command

The Appriss Insights Equifax Victim Information Notification Exchange VINE applications allow an unauthenticated attacker to send a specially-crafted request to bypass the login page, access other users' credentials, take over other user accounts, access sensitive PII, and dump other information...

CVE-2026-65532: Improper Neutralization of Special Elements used in an SQL Command

Shop manager SQL Injection in Persian Woocommerce SMS = 7.2.2 versions...

CVE-2026-65494: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Dokan Pro = 5.0.2 versions...

CVE-2026-65454: Improper Neutralization of Special Elements used in an SQL Command

Contributor SQL Injection in Quiz And Survey Master = 11.2.0 versions...

CVE-2026-61949: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Bookly = 27.7 versions...

CVE-2026-24552: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in John-Michael L'Allier Create mediavine-create allows Blind SQL Injection.This issue affects Create: from n/a through 2.5.3...

CVE-2026-15906: Improper Neutralization of Special Elements used in an SQL Command

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing...

PT-2026-63790

The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tc order status filter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...