CVE-2026-76556

The WP Import Export Lite WordPress plugin, in versions prior to 3.9.33 , is vulnerable to SQL injection due to the improper sanitization and escaping of certain export filter values before they are utilized in SQL statements. This flaw allows authenticated users with export permissions—which inc...

CVE-2026-16588

The WP Directory Kit plugin for WordPress is vulnerable to blind SQL Injection via the 'orderby' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

CVE-2026-16588 WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'order_by' Parameter

The WP Directory Kit plugin for WordPress is vulnerable to blind SQL Injection via the 'orderby' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

CVE-2026-16588

The WP Directory Kit WordPress plugin (versions up to and including 1.5.4 ) is vulnerable to blind SQL injection through the order_by parameter, caused by insufficient escaping of user-supplied input and lack of proper query preparation. An authenticated attacker with custom-level access or highe...

CVE-2026-16588 WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'order_by' Parameter

The WP Directory Kit plugin for WordPress is vulnerable to blind SQL Injection via the 'orderby' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

EUVD-2026-80095

The WP Directory Kit plugin for WordPress is vulnerable to blind SQL Injection via the 'orderby' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

CVE-2026-92221

A vulnerability was determined in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this vulnerability is the function generateindexpasien of the file application/models/appglobaladminmodel.php. Executing a manipulation of the argument cari can lead to sql...

CVE-2026-92221 gedelumbung HospitalManagement app_global_admin_model.php generate_index_pasien sql injection

A vulnerability was determined in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this vulnerability is the function generateindexpasien of the file application/models/appglobaladminmodel.php. Executing a manipulation of the argument cari can lead to sql...

CVE-2026-92221 gedelumbung HospitalManagement app_global_admin_model.php generate_index_pasien sql injection

A vulnerability was determined in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this vulnerability is the function generateindexpasien of the file application/models/appglobaladminmodel.php. Executing a manipulation of the argument cari can lead to sql...

CVE-2026-92221

A SQL injection vulnerability exists in gedelumbung HospitalManagement (up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8), specifically in the function generate_index_pasien within application/models/app_global_admin_model.php. Manipulating the cari argument allows a remote attacker with hig...

CVE-2026-92221 gedelumbung HospitalManagement app_global_admin_model.php generate_index_pasien sql injection

A vulnerability was determined in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this vulnerability is the function generateindexpasien of the file application/models/appglobaladminmodel.php. Executing a manipulation of the argument cari can lead to sql...

EUVD-2026-80082

A vulnerability was determined in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this vulnerability is the function generateindexpasien of the file application/models/appglobaladminmodel.php. Executing a manipulation of the argument cari can lead to sql...

SQLi_PW

SQLi SQL injection là gì? SQL Injection SQLi là một lỗ h...

PT-2026-94004

Name of the Vulnerable Software and Affected Versions Cisco ISE affected versions not specified Description Insufficient validation of certain parameters concatenated into SQL queries in the APIs allows an authenticated remote attacker with administrative credentials to perform SQL injection...

PT-2026-93935

Tanium addressed a SQL injection vulnerability in Asset...

PT-2026-94027

Name of the Vulnerable Software and Affected Versions Cisco ISE affected versions not specified Cisco ISE-PIC affected versions not specified Description An issue in the REST API allows an authenticated remote attacker with administrative credentials to perform SQL injection attacks against the...

CVE-2026-76557: Improper Neutralization of Special Elements used in an SQL Command

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some import configuration values before using them in SQL statements, allowing users whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import permission ...

CVE-2026-76556: Improper Neutralization of Special Elements used in an SQL Command

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values before using them in SQL statements, allowing users holding its export permission, which administrators have by default and may also grant to lower roles, to perform SQL...

ALSA-2026:67848 Important: postgresql:18 security update

PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: SQL injection in pgcreatesubscriber allows arbitrary SQL execution as superuser CVE-2026-6476 postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector an...

VulnCheck KEV: CVE-2022-0412

The TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI WooCommerce Wishlist Pro WordPress plugin before 1.40.1 do not sanitise and escape the itemid parameter before using it in a SQL statement via the wishlist/removeproduct REST endpoint, allowing unauthenticated attackers to perform SQL...