11 matches found
PT-2026-92402
Concrete CMS 9 before 9.5.3 did not escape SQL LIKE wildcard characters in the keyword search filters used by the file manager, file folders, and page list, allowing an authenticated user with editor-level or higher privileges to submit a crafted search containing many single-character wildcards...
EUVD-2026-62453
phpMyFAQ before 4.1.7, when configured to use PostgreSQL via the native pgsql PHP extension, declares an incorrect LIKE ESCAPE character '=' in the Search/Database/Pgsql.php backend while escapeLikeWildcards escapes user input with the '|' prefix. As a result, wildcard escaping is a no-op and...
PT-2026-78394
phpMyFAQ before 4.1.7, when configured to use PostgreSQL via the native pgsql PHP extension, declares an incorrect LIKE ESCAPE character '=' in the Search/Database/Pgsql.php backend while escapeLikeWildcards escapes user input with the '|' prefix. As a result, wildcard escaping is a no-op and...
CVE-2026-3835
The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the getadvancefilebyurl method in all versions up to, and including, 2.8.8.8 The method uses a SQL LIKE operator for token looku...
CVE-2026-3835
The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the getadvancefilebyurl method in all versions up to, and including, 2.8.8.8 The method uses a SQL LIKE operator for token looku...
CVE-2026-3835 Prevent Direct Access – Protect WordPress Files <= 2.8.8.8 - Unauthenticated Protected File Access
The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the getadvancefilebyurl method in all versions up to, and including, 2.8.8.8 The method uses a SQL LIKE operator for token looku...
EUVD-2026-57720
The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the getadvancefilebyurl method in all versions up to, and including, 2.8.8.8 The method uses a SQL LIKE operator for token looku...
CVE-2026-3835 Prevent Direct Access – Protect WordPress Files <= 2.8.8.8 - Unauthenticated Protected File Access
The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the getadvancefilebyurl method in all versions up to, and including, 2.8.8.8 The method uses a SQL LIKE operator for token looku...
CVE-2026-3835
The CVE covers the WordPress plugin Prevent Direct Access – Protect WordPress Files. All versions up to 2.8.8.8 are affected due to insufficient token validation in get_advance_file_by_url(), which uses a SQL LIKE without escaping wildcards via $wpdb->esc_like(). This allows unauthenticated us...
PT-2026-71388
The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the get advance file by url method in all versions up to, and including, 2.8.8.8 The method uses a SQL LIKE operator for token...
CVE-2026-25591 New API has an SQL LIKE Wildcard Injection DoS via Token Search
New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to version 0.10.8-alpha.10, a SQL LIKE wildcard injection vulnerability in the /api/token/search endpoint allows authenticated users to cause denial of service through resource exhaustion by...