PT-2026-61987

A SQL injection CWE-89 and security boundary bypass CWE-863 vulnerability exists in the prebuilt BigQuery forecasting tool bigquery-forecast of googleapis/mcp-toolbox. The tool accepts client-controlled parameters data col, timestamp col, and id cols as plain strings and interpolates them unescap...

PT-2026-62035

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. A SQL injection vulnerability was identified in the SqlView API endpoint of the DHIS2 application in the filter parameter used by the /api/sqlViews/viewId/data.json endpoint. An...

📄 WordPress Easy Form Builder 3.8.14 Unauthenticated Blind SQL Injection

WordPress Easy Form Builder plugin version 3.8.14 contains an unauthenticated time-based blind SQL injection vulnerability through REST. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit demonstrate...

CVE-2026-52469

SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the DeviceInfoMapper.xml file...

CVE-2026-52472

SQL injection vulnerability in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the PortInfoMapper.xml file...

CVE-2026-61294: Improper Neutralization of Special Elements used in an SQL Command

Vulnerability in the Oracle Common Applications Calendar product of Oracle E-Business Suite component: Calendar Synchronizations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise...

CVE-2026-60582: Improper Neutralization of Special Elements used in an SQL Command

Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite component: Core. The supported version that is affected is V16. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Command...

CVE-2026-16484: Improper Neutralization of Special Elements used in an SQL Command

A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /editsubjecta.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published...

CVE-2026-52469: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the DeviceInfoMapper.xml file...

CVE-2026-64877: Improper Input Validation

An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database...

CVE-2026-55082: Improper Neutralization of Special Elements used in an SQL Command

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. DHIS2 SQL View data endpoints allowed authenticated users with SQL View access to provide crafted filter values that were interpolated into generated SQL. An authenticated user with acces...

CVE-2026-16334: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in itsourcecode Hospital Management System 1.0. This vulnerability affects unknown code of the file /prescriptionorder.php. Such manipulation of the argument editid leads to sql injection. The attack can be launched remotely. The exploit is publicly available and...

📄 WordPress Easy Quotes 1.2.2 Unauthenticated Blind SQL Injection

WordPress Easy Quotes plugin version 1.2.2 contains an unauthenticated time-based blind SQL injection vulnerability through REST. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit demonstrates the...

PT-2026-61839

The bpost-shipping-platform WordPress plugin before 3.2.3 does not properly sanitize a parameter before using it in a SQL query during WooCommerce order submission, allowing unauthenticated attackers to perform time-based blind SQL injection on stores running this bpost-shipping-platform WordPres...

PT-2026-62086

Name of the Vulnerable Software and Affected Versions Crocus version 1.3.44 Description A SQL injection flaw allows a remote attacker to escalate privileges. This issue occurs through the DeviceInfoMapper.xml file. SQL injection is a technique where malicious SQL statements are inserted into entr...

📄 WordPress Contact Forms by CRM Perks 1.0.7 Unauthenticated Blind SQL Injection

WordPress Contact Forms by CRM Perks plugin version 1.0.7 contains an unauthenticated time-based blind SQL injection vulnerability. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit demonstrates the...

📄 WordPress Quiz and Survey Master 10.2.4 Authenticated Contributor SQL Injection

WordPress Quiz And Survey Master plugin version 10.2.4 contains an authenticated Contributor+ SQL injection vulnerability through REST. A remote attacker can inject arbitrary SQL into database queries handled by the affected component. This proof of concept exploit demonstrates the vulnerable...

CVE-2026-52472

The software Wgcloud 3.6.4 is vulnerable to an SQL injection flaw that allows a remote attacker to escalate privileges . The vulnerability is specifically triggered via the PortInfoMapper.xml file. Exploitation details or proof-of-concept links are not provided in the documents.

Linux Distros Unpatched Vulnerability : CVE-2026-60137

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the authornotin parameter of WPQuery, which could allow SQL...

Linux Distros Unpatched Vulnerability : CVE-2026-63030

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the authornotin WPQuery...