250888 matches found
CVE-2026-65877
CVE-2026-65877 affects the Joomla extension SP Page Builder (
CVE-2026-65766
Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder 6.7.1 - Improper validation of order parameters in the Dynamic Content endpoint leads to an SQL injection vector...
CVE-2026-65766 Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.1
Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder 6.7.1 - Improper validation of order parameters in the Dynamic Content endpoint leads to an SQL injection vector...
EUVD-2026-49197
Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder 6.7.1 - Improper validation of order parameters in the Dynamic Content endpoint leads to an SQL injection vector...
security-advisories
Threat Lance Security Advisories Public security advisory rep...
CVE-2026-14189
The WPBot WordPress plugin before 8.5.2 does not validate administrator-configured field identifiers before using them in a SQL query, allowing users with administrator access to perform SQL injection that executes when a visitor triggers a search...
CVE-2026-14189
The WPBot WordPress plugin before 8.5.2 does not validate administrator-configured field identifiers before using them in a SQL query, allowing users with administrator access to perform SQL injection that executes when a visitor triggers a search...
EUVD-2026-49076
The WPBot WordPress plugin before 8.5.2 does not validate administrator-configured field identifiers before using them in a SQL query, allowing users with administrator access to perform SQL injection that executes when a visitor triggers a search...
BIT-WORDPRESS-MULTISITE-2026-60137 WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the authornotin parameter of WPQuery, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter...
BIT-WORDPRESS-2026-63030 WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the authornotin WPQuery SQL Injection CVE-2026-60137, could allow an attacker to perform SQL Injection and achieve Remote Code Execution...
BIT-WORDPRESS-2026-60137 WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the authornotin parameter of WPQuery, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter...
BIT-OPENBAO-2026-39946 OpenBao allows SQL Injection in PostgreSQL database secrets engine
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, when OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by PostgreSQL. This could lead to role revocation...
CVE-2026-65877: Improper Neutralization of Special Elements used in an SQL Command
Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder 6.7.1 - Improper validation of various parameters in the media manager search and date filters lead to an SQL injection vector...
WordPress SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin <= 3.9.7 - Authenticated (Administrator+) SQL Injection vulnerability
Authenticated Administrator+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin SMS Alert Order Notifications versions = 3.9.7...
CVE-2025-50455
A blind SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments versions
CVE-2026-59537: Improper Neutralization of Special Elements used in an SQL Command
Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce = 2.10.22 versions...
PT-2026-64932
Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce = 2.10.22 versions...
PT-2026-64937
Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress = 4.7.10 versions...