WordPress Bit Form plugin <= 3.2.0 - Authenticated (Administrator+) SQL Injection via 'filterText' Parameter vulnerability

Authenticated Administrator+ SQL Injection via 'filterText' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Bit Form versions = 3.2.0...

WordPress affiliate-toolkit plugin <= 3.8.8 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter vulnerability

Authenticated Administrator+ SQL Injection via 'orderby' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin affiliate-toolkit versions = 3.8.8...

GO-2023-1832 vulnerabilities

Vulnerabilities for packages: zot...

GO-2023-1568 vulnerabilities

Vulnerabilities for packages: kubeflow-katib...

GO-2022-1039 vulnerabilities

Vulnerabilities for packages: kubeflow-katib...

GO-2024-2629 vulnerabilities

Vulnerabilities for packages: grafana-fips...

GO-2024-2517 vulnerabilities

Vulnerabilities for packages: grafana-fips...

GO-2024-2520 vulnerabilities

Vulnerabilities for packages: grafana-fips...

GO-2025-3585 vulnerabilities

Vulnerabilities for packages: harbor, harbor-fips...

GO-2024-3331 vulnerabilities

Vulnerabilities for packages: harbor, harbor-fips...

GO-2025-3384 vulnerabilities

Vulnerabilities for packages: grafana-fips, grafana...

GO-2023-1704 vulnerabilities

Vulnerabilities for packages: go, kubeflow-katib...

GO-2025-3953 vulnerabilities

Vulnerabilities for packages: temporal...

GO-2026-4465 vulnerabilities

Vulnerabilities for packages: spicedb...

GO-2023-2020 vulnerabilities

Vulnerabilities for packages: promxy, prometheus-alertmanager...

GO-2025-3607 vulnerabilities

Vulnerabilities for packages: harbor, tailscale...

GO-2023-1703 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, go...

GO-2020-0005 vulnerabilities

Vulnerabilities for packages: dgraph...

CVE-2026-16810

The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'dataqueryCondition' parameter in all versions up to, and including, 3.2.0 due to insufficient escaping on the user supplied parameter...

CVE-2026-15205

The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows...