CVE-2025-26887

CVE-2025-26887 is a Stored XSS in EZ SQL Reports Shortcode Widget and DB Backup for WordPress. Affected: EZ SQL Reports Shortcode Widget and DB Backup (vulnerable range up to 5.21.35). Root cause per description: Improper Neutralization of Input During Web Page Generation (XSS). Impact details in...

WordPress plugin EZ SQL Reports Shortcode Widget and DB Backup has a cross-site scripting vulnerability.

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2025-7837 · Db Backup +1 · Db Backup +1

Name of the Vulnerable Software and Affected Versions: EZ SQL Reports Shortcode Widget and DB Backup versions n/a through 5.21.35 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attack...

CVE-2025-26887: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Eli EZ SQL Reports Shortcode Widget and DB Backup elisqlreports allows Stored XSS.This issue affects EZ SQL Reports Shortcode Widget and DB Backup: from n/a through = 5.21.35...

WordPress EZ SQL Reports Shortcode Widget and DB Backup plugin <= 5.21.35 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin EZ SQL Reports Shortcode Widget and DB Backup versions = 5.21.35...

WordPress EZ SQL Reports Shortcode Widget and DB Backup RCE

Remote command execution vulnerability in WordPress EZ SQL Reports Shortcode Widget and DB Backup plugin shortcode parameter Vulnerability Type: Remote Command Execution For the exploit source code contact DSquare Security sales team...

WordPress EZ SQL Reports Shortcode Widget and DB Backup SQL Injection

SQL Injection vulnerability in WordPress EZ SQL Reports Shortcode Widget and DB Backup plugin shortcode parameter Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...

EZ SQL Reports <= 4.11.33 - Authenticated Arbitrary Code Execution

There are several calls to "passtthru" in the code, one of them is receiving the username, password, database name and host from the $POST arguments, so you can inject in every of this parameter the ";" character or others like "&&" or "||" to execute other distinct commands to "/usr/bin/mysql"...

WordPress Plugin EZ SQL Reports 4.11.37 - Multiple Vulnerabilities

WordPress Plugin EZ SQL Reports 4.11.37 - Multiple Vulnerabilities Exploit Title: EZ SQL Reports Proxy-Connection: keep-alive Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Upgrade-Insecure-Requests: 1 User-Agent: Referer:...

EZ SQL Reports <= 4.11.33 - Authenticated Arbitrary File Download

The plugin allows a WordPress site administrator or collaborator to download arbitrary files from the host file system though the plugin functionality of downloading .sql, .sql.zip or .sql.gz files created by the WordPress administrator. The file name to download is not sanitized and path travers...

WordPress Plugin EZ SQL Reports < 4.11.37 - Multiple Vulnerabilities

Exploit Title: EZ SQL Reports Proxy-Connection: keep-alive Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Upgrade-Insecure-Requests: 1 User-Agent: Referer: http:///wp-admin/admin.php?page=ELISQLREPORTS-settings Accept-Encoding: gzip, deflate, sdch Accept-Language...

Sql injection

SQL injection vulnerability in the SQL Reports comsqlreport component 1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the userid parameter to ajax/print.php. NOTE: some of these details are obtained from third party information...

CVE-2010-0753

SQL injection vulnerability in the SQL Reports comsqlreport component 1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the userid parameter to ajax/print.php. NOTE: some of these details are obtained from third party information...