CVE-2026-93591 SiYuan before 3.8.3 SQL Injection via unescaped tag in graph.go

SiYuan versions before 3.8.3 contain an SQL injection vulnerability in the graph.go query2Stmt function where tag values are concatenated raw into SQL string literals without escaping single quotes. A publish-mode reader or anonymous visitor can inject SQL via inline HTML span tags in the getGrap...

WordPress WP Multi Store Locator Pro plugin <= 4.5.1 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Rafie Muhammad in WordPress Plugin WP Multi Store Locator Pro versions = 4.5.1...

SqlInjectionClass

Laboratorio de Seguridad Web: SQL Injection & Cross-Site Scrip...

WordPress Yo plugin 1.1-1.3.1 - Unauthenticated SQL Injection via username Parameter vulnerability

Unauthenticated SQL Injection via username Parameter vulnerability discovered by João Ramos Maciel in WordPress Plugin Yo versions 1.1-1.3.1...

WordPress WP Shortcut Link plugin <= 1.2.0 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Theo Antônio Da Fonseca in WordPress Plugin WP Shortcut Link versions = 1.2.0...

WordPress Product Question and Answer plugin <= 1.1.0 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Theo Antônio Da Fonseca in WordPress Plugin Product Question and Answer versions = 1.1.0...

WordPress Tz Weekly Radio Schedule plugin <= 1.8.1 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Theo Antônio Da Fonseca in WordPress Plugin Tz Weekly Radio Schedule versions = 1.8.1...

WordPress Price Drop Alert for WooCommerce plugin <= 1.1 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Theo Antônio Da Fonseca in WordPress Plugin Price Drop Alert for WooCommerce versions = 1.1...

CVE-2026-4036

An improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Sharing API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain arbitrary sharing files...

CVE-2026-13683

An improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability in EventScheduler API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with administrator privileges to obtain...

WordPress WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin <= 3.8.2 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin WCFM Marketplace versions = 3.8.2...

EUVD-2026-82786

An improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Sharing API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain arbitrary sharing files...

CVE-2026-4036

An improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Sharing API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain arbitrary sharing files...

CVE-2026-4036

CVE-2026-4036 is an SQL injection vulnerability in the Sharing API of Synology DiskStation Manager (DSM), affecting versions before 7.2.1-69057-10 , 7.2.2-72806-7 , and 7.3.2-86009-2 . A remote authenticated user can exploit it to obtain arbitrary sharing files . The CVSS 3.1 score is 6.5 (MEDIUM...

CVE-2026-4036

An improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Sharing API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain arbitrary sharing files...

CVE-2026-13683

An improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability in EventScheduler API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with administrator privileges to obtain...

EUVD-2026-82781

An improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability in EventScheduler API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with administrator privileges to obtain...

CVE-2026-13683

CVE-2026-13683 is a SQL Injection vulnerability in the EventScheduler API of Synology DiskStation Manager (DSM) , affecting versions before 7.2.1-69057-12 , 7.2.2-72806-9 , 7.3.2-86009-4 , and 7.4-90075 . The flaw arises from improper neutralization of special elements in SQL commands. Exploitati...

CVE-2026-13683

An improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability in EventScheduler API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with administrator privileges to obtain...

CVE-2026-85705

The Location Manager plugin for WordPress is vulnerable to generic SQL Injection via 'latitude' and 'longitude' REST API Parameters in all versions up to, and including, 2.3.38 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...