264181 matches found
CVE-2026-79752
CakePHP , a rapid development framework for PHP, is affected by an SQL injection vulnerability in src/Database/FunctionsBuilder.php. The methods FunctionsBuilder::cast , ::extract , ::datePart , and ::dateAdd accept user-controlled dataType, part, or unit values and incorporate them into generate...
CVE-2026-79752 CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection
CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit valu...
CVE-2026-79752
CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit valu...
CVE-2026-79752 CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection
CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit valu...
EUVD-2026-81673
CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit valu...
CVE-2026-66631
Administrator SQL Injection in MC Woocommerce Wishlist = 1.9.21 versions...
CVE-2026-66625
Administrator SQL Injection in WC Vendors Marketplace = 2.7.2.1 versions...
CVE-2026-66630
Administrator SQL Injection in PublishPress Series = 3.1.3 versions...
CVE-2026-66628
Shop manager SQL Injection in WP-Lister Lite for eBay = 3.8.11 versions...
CVE-2026-66626
Editor SQL Injection in SKT Addons for Elementor = 4.0 versions...
CVE-2026-66624
Administrator SQL Injection in WPMasterToolKit = 2.22.0 versions...
CVE-2026-66618
Administrator SQL Injection in WP Maps = 4.9.9 versions...
CVE-2026-66619
Administrator SQL Injection in Newsletters = 4.18 versions...
CVE-2026-66580
Contributor SQL Injection in Product Feed Manager = 7.12.0 versions...
CVE-2026-77874
A flaw was found in Hibernate ORM. This vulnerability allows an authenticated attacker to inject arbitrary SQL commands into the underlying database by manipulating the JSON path argument. The issue arises from improper handling of JSON path segments in the...
SQL Injection
Overview snowflake-cli is a Snowflake CLI Affected versions of this package are vulnerable to SQL Injection via the process that interpolates user-controlled values into SQL strings. An attacker can execute arbitrary SQL statements in the context of the victim's session and active role by providi...
CVE-2026-66630 WordPress PublishPress Series plugin <= 3.1.3 - SQL Injection vulnerability
Administrator SQL Injection in PublishPress Series = 3.1.3 versions...
CVE-2026-66631 WordPress MC Woocommerce Wishlist plugin <= 1.9.21 - SQL Injection vulnerability
Administrator SQL Injection in MC Woocommerce Wishlist = 1.9.21 versions...