284984 matches found
CVE-2026-90526: Improper Neutralization of Special Elements used in an SQL Command
A security vulnerability has been detected in SourceCodester School Registration and Fee System 1.0. This impacts an unknown function of the file /bilal/saveclass.php. The manipulation of the argument Category leads to sql injection. Remote exploitation of the attack is possible. The exploit has...
PT-2026-90785
A vulnerability has been found in Fengoffice Feng Office up to 3.11.13.11. This impacts the function Contacts::instance-findAll of the file application/models/CompanyWebsite.class.php of the component Legacy API. Such manipulation of the argument auth leads to sql injection. The attack can be...
PT-2026-90940
🚨 CVE-2020-15875 An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via a SQL injection in the searchPhrase parameter in the /ajax table.php API endpoint. This affects as-selection.inc.php,...
EUVD-2020-31272
An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via a SQL injection in the searchPhrase parameter in the /ajaxtable.php API endpoint. This affects as-selection.inc.php, edit-ports.inc.php,...
CVE-2019-9053
CVE-2019-9053 エクスプロイト - CMS Made Simple 未認証SQLインジェクション SQLi CVE-2019-9053 用のエクスプロイトスクリプトです。これは、CMS Made Simple バージョン 2.2.9 以下 における深刻な 未認証SQLインジェクション SQLi 脆弱性です。このツールは、時間ベースのSQLインジェクション を利用して、脆弱な CMS Made Simple サイトから 管理者認証情報 （ユーザー名、メールアドレス、パスワードハッシュ、ソルト）を抽出します。また、ワードリストを使用した任意の パスワードクラッキング...
CVE-2026-77161
The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Injection via Parameter Name in all versions up to, and including, 5.1.24 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...
CVE-2026-85198
The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin for WordPress is vulnerable to generic SQL Injection via URL Path in all versions up to, and including, 4.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
CVE-2026-16482
The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'compare' parameter in all versions up to, and including, 4.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
CVE-2026-77161 Smart Marketing SMS and Newsletters Forms <= 5.1.24 - Authenticated (Subscriber+) SQL Injection via Parameter Name
The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Injection via Parameter Name in all versions up to, and including, 5.1.24 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...
CVE-2026-77161
The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to SQL Injection via Parameter Name in all versions up to and including 5.1.24 . The root cause is insufficient escaping on a user-supplied parameter and lack of sufficient preparation of the existing SQL query, allo...
EUVD-2026-76835
The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Injection via Parameter Name in all versions up to, and including, 5.1.24 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...
CVE-2026-77161 Smart Marketing SMS and Newsletters Forms <= 5.1.24 - Authenticated (Subscriber+) SQL Injection via Parameter Name
The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Injection via Parameter Name in all versions up to, and including, 5.1.24 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...
CVE-2026-85198
The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO WordPress plugin is vulnerable to SQL injection via URL path in versions up to and including 4.2.1 , caused by insufficient escaping and lack of prepared statements on a user-supplied parameter. Despite the title referencing...
CVE-2026-85198 MPG <= 4.2.1 - Unauthenticated SQL Injection via URL Path
The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin for WordPress is vulnerable to generic SQL Injection via URL Path in all versions up to, and including, 4.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
CVE-2026-85198 MPG <= 4.2.1 - Unauthenticated SQL Injection via URL Path
The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin for WordPress is vulnerable to generic SQL Injection via URL Path in all versions up to, and including, 4.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
EUVD-2026-76831
The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin for WordPress is vulnerable to generic SQL Injection via URL Path in all versions up to, and including, 4.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
CVE-2026-16482 rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 - Unauthenticated SQL Injection via 'compare' Parameter
The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'compare' parameter in all versions up to, and including, 4.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
CVE-2026-16482
The rtMedia for WordPress, BuddyPress and bbPress plugin (up to and including 4.7.11 ) is vulnerable to an unauthenticated time-based blind SQL Injection via the compare parameter. The root cause lies in RTMediaQuery::query(), which merges $_REQUEST into the internal query while only validating t...
EUVD-2026-76828
The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'compare' parameter in all versions up to, and including, 4.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
CVE-2026-16482 rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 - Unauthenticated SQL Injection via 'compare' Parameter
The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'compare' parameter in all versions up to, and including, 4.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...