SQL Injection

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to SQL Injection via the searchUsers process. An attacker can retrieve sensitive user information, such as user IDs and display names, by submitting...

Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax

Impact The Backend Filter widget Backend\Widgets\Filter is vulnerable to SQL injection through the numberrange scope type when the scope is configured with a conditions key. An authenticated backend user with access to a list view containing a vulnerable filter scope can inject arbitrary SQL via...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection in the numberrange scope of the backend filter widget when the conditions key is configured. An attacker can access sensitive database information by injecting arbitrary SQL through the filter's AJAX handler. This is only...

Exploit for CVE-2026-72898

🔴 CVE-2026-72898 - Unauthenticated SQL Injection Met...

WordPress Web Directory Free plugin <= 1.7.13 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Taylsec in WordPress Plugin Web Directory Free versions = 1.7.13...

dvwa-rce-finding-chain

DVWA Finding Chain: Stored XSS to Persistent RCE A pentes...

WordPress MailChimp For WooCommerce plugin < 6.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin MailChimp For WooCommerce versions 6.2...

Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws

Adobe has shipped updates to address multiple critical security vulnerabilities impacting ColdFusion, Commerce, and Campaign Classic that, if successfully exploited, could result in arbitrary code execution and privilege escalation. The most severe of the flaws are listed below - CVE-2026-48362...

WordPress Booktics plugin 1.0.22 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Abdullah Kareem "cyberkareem" in WordPress Plugin Booktics versions 1.0.22...

WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Jayant Kamble in WordPress Plugin WP Directory Kit versions = 1.5.4...

CVE-2026-17346

A flaw was found in pgAdmin 4. A low-privileged user can exploit a SQL injection vulnerability when object names, such as schema, table, publication, or subscription names, containing special characters are not properly escaped. When any user, including those with higher privileges, views the...

CVE-2025-41771

An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limited to the system’s notification...

EUVD-2025-210707

An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limited to the system’s notification...

CVE-2025-41771 SQL injection

An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limited to the system’s notification...

CVE-2025-41771

An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limited to the system’s notification...

CVE-2025-41771

CVE-2025-41771 details an SQL injection vulnerability exploitable by an authenticated user with low privileges via an endpoint in the controller’s web interface. The flaw affects a SQLite database used solely for storing notification messages, so the impact is limited to the system’s notification...

GHSA-VWF4-M7J8-WCJF

creationtimestamp| type| source ---|---|--- 2026-08-12 08:00:05+00:00| seen| Telegram/ZtTgk35S8DFYm2bUVjFVqqtPnGYEzTcbCUrks9IGhgQhA 2026-08-13 00:00:43+00:00| published-proof-of-concept| Telegram/ZtTgk35S8DFYm2bUVjFVqqtPnGYEzTcbCUrks9IGhgQhA 2026-08-16 20:29:14+00:00| seen|...

CVE-2026-66659

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Essekia Tablesome Table allows Blind SQL Injection. This issue affects Tablesome Table: from n/a through 1.2.9...

CVE-2026-18474

The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when a non-default search field type is configured...

CVE-2026-18230

The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks an authorization check, allowing any authenticated user such as a Subscriber to perform SQL injection attacks...