EUVD-2026-47934

The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' and 'table' parameters in the uploaded cart JSON file processed by the checkout AJAX action in versions up to, and including, 2.1.1. This is due to insufficient escaping on the user-suppli...

mariadb-connector-c security update

An update is available for mariadb-connector-c. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The MariaDB Native Client library C driver is used to connect...

RLSA-2026:43505 Important: mariadb-connector-c security update

The MariaDB Native Client library C driver is used to connect applications developed in C/C++ to MariaDB and MySQL databases. Security Fixes: mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysqlrealescapestring CVE-2026-44172 For more details...

WordPress Dokan Pro plugin <= 5.0.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Expatch in WordPress Plugin Dokan Pro versions = 5.0.2...

Exploit for Interpretation Conflict in Wordpress

CVE-2026-63030 / CVE-2026-60137 — "wp2shell" WordPress Core RC...

Exploit for SQL Injection in Ivanti Endpoint_Manager

CVE-2024-50330: Ivanti Endpoint Manager EPM SQL Injection to...

PT-2026-64075

Summary The FileCatalog DatasetManager runs a query on the database and passes the result to eval. The SQL query contains an injection vulnerability which allows an authenticated user to control the parameter returned to the eval resulting in remote code execution. Details The FileCatalog...

CVE-2026-13119: Improper Neutralization of Special Elements used in an SQL Command

The Registrations For The Events Calendar plugin for WordPress is vulnerable to SQL Injection via JSON keys in the 'standard' parameter handled by the rtecrecordsedit AJAX action in versions up to and including 3.2. The handler decodes attacker-controlled JSON from $POST'standard' and uses the JS...

CVE-2026-59526: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in MapSVG = 8.14.0 versions...

CVE-2026-15448: Improper Neutralization of Special Elements used in an SQL Command

The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tcorderstatusfilter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existi...

CVE-2026-65462: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in Uncanny Automator = 7.3.2 versions...

PT-2026-63873

Contributor SQL Injection in MapSVG = 8.14.0 versions...

PT-2026-63785

The Registrations For The Events Calendar plugin for WordPress is vulnerable to SQL Injection via JSON keys in the 'standard' parameter handled by the rtec records edit AJAX action in versions up to and including 3.2. The handler decodes attacker-controlled JSON from $ POST'standard' and uses the...

CVE-2026-61948: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in WPDM – Premium Packages = 6.2.0 versions...

Debian dsa-6399 : wordpress - security update

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6399 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6399-1 [email protected] https://www.debian.org/security/...

PT-2026-63865

Unauthenticated SQL Injection in Bookly = 27.7 versions...

PT-2026-63790

The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tc order status filter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2026-25405: Improper Neutralization of Special Elements used in an SQL Command

Contributor SQL Injection in eRoom = 1.7.1 versions...

PT-2026-63849

Unauthenticated SQL Injection in Participants Database = 2.7.8.3 versions...

RockyLinux 10 : mariadb-connector-c (RLSA-2026:43505)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:43505 advisory. mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysqlrealescapestring CVE-2026-44172 Tenable has extracted...