penetration-testing-system-network-security

Penetration Testing & System and Network Security Team univer...

WordPress GamiPress plugin <= 8.0.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Bruno Alvarenga in WordPress Plugin GamiPress versions = 8.0.2...

WordPress WP Data Access plugin <= 5.5.84 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Raphael P. Cigana in WordPress Plugin WP Data Access versions = 5.5.84...

WordPress Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin <= 3.0.4 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Ivaylo in WordPress Plugin BP Better Messages versions = 3.0.4...

CVE-2026-93899

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to generic SQL Injection via 'groupid' Message Meta Parameter in all versions up to, and including, 3.0.4 due to insufficient escaping on the user supplied parameter and lack of...

EUVD-2026-86537

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to generic SQL Injection via 'groupid' Message Meta Parameter in all versions up to, and including, 3.0.4 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-93899 Better Messages <= 3.0.4 - Authenticated (Subscriber+) SQL Injection via 'group_id' Message Meta Parameter

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to generic SQL Injection via 'groupid' Message Meta Parameter in all versions up to, and including, 3.0.4 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-93899 Better Messages <= 3.0.4 - Authenticated (Subscriber+) SQL Injection via 'group_id' Message Meta Parameter

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to generic SQL Injection via 'groupid' Message Meta Parameter in all versions up to, and including, 3.0.4 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-93899

The Better Messages plugin for WordPress (all versions up to and including 3.0.4 ) is vulnerable to a generic SQL Injection via the 'group_id' Message Meta Parameter. The root cause is insufficient escaping of the user-supplied parameter and a lack of sufficient preparation on the existing SQL qu...

Exploit for CVE-2026-48842

CVE-2026-48842 — Roundcube virtuserquery pre-auth SQLi Pytho...

Multiple vulnerabilities in baserCMS

Overview baserCMS provided by baserCMS User Community contains multiple vulnerabilities listed below: Cross-site scripting CWE-79 - CVE-2026-93460, CVE-2026-93463, CVE-2026-93464 SQL injection CWE-89 - CVE-2026-62956 Missing authentication for critical function CWE-306 - CVE-2026-93462...

sql-injection-labs

SQL Injection Labs — PortSwigger Web Security Academy A colle...

PT-2026-98878

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 16.4.0 Description The application fails to perform numeric validation on dimension width, height, ratio, and filesize values provided via the Batch Manager filter URL in the 'admin/batch manager.php' endpoint. These...

PT-2026-98891

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 16.4.0 Description An authenticated administrator can store a crafted expression via the image order variable in the 'admin/element set ranks.php' endpoint because the application fails to enforce the sort-field...

CVE-2026-84893: Improper Neutralization of Special Elements used in an SQL Command

IBM Guardium Data Protection 12.2 is vulnerable to SQL injection in the PESI service. An authenticated attacker could exploit this vulnerability to access sensitive information in the internal database...

CVE-2026-62262: Improper Neutralization of Special Elements used in an SQL Command

Piwigo is a full featured open source photo gallery application for the web. In 17.0.0beta1 and earlier, when rating is enabled, an unauthenticated guest can call pwg.images.filteredSearch.create with a crafted ratings value and then open the returned search URL. include/wsfunctions/pwg.images.ph...

CVE-2026-44642: Improper Neutralization of Special Elements used in an SQL Command

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, checkupgradeaccessrights in admin/include/functionsupgrade.php conditionally escapes the submitted username only when the removed getmagicquotesgpc function exists, so PHP 8 and later concatenate an...

CVE-2026-42324: Improper Neutralization of Special Elements used in an SQL Command

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/elementsetranks.php stores administrator-controlled imageorder values without enforcing the existing sort-field whitelist. The stored album imageorder expression is later concatenated into ORDER BY...

PT-2026-98875

Name of the Vulnerable Software and Affected Versions InvoicePlane versions prior to 1.7.2 Description InvoicePlane fails to perform strict integer validation on the tax rate decimal places setting, which is controlled by the administrator. This value is interpolated into an ALTER TABLE statement...

PT-2026-98961

Name of the Vulnerable Software and Affected Versions CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be Description A remote SQL injection exists in the updatefaculty.php file. The issue occurs when the fid argument is manipulated, allowing an attacker to execute...