CVE-2026-82583 NextGen Healthcare Mirth Connect SQL Injection

NextGen Connect Mirth Connect versions 4.7.1 and earlier allow an authenticated user to execute arbitrary SQL through a Database Connector API, which could result in disclosure of stored credentials for connected systems, arbitrary file write, and a denial-of-service condition...

practical-penetration-testing-lab

Practical Penetration Testing Lab Project Overview This p...

WordPress Sky Addons for Elementor plugin <= 3.8.4 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Sky Addons for Elementor versions = 3.8.4...

WordPress Amelia plugin <= 2.4.9 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Amelia versions = 2.4.9...

CVE-2026-18561

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, and including, 2.0.16. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query in...

CVE-2026-15462

The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scwformfields' parameter array keys of the 'scwsaveformdata' AJAX action in versions up to, and including, 1.4.2. This is due to the saveformdata function passing attacker-controlled POST array keys unsanitized to...

Security-labs

Security Labs — Complete Portfolio Student: Waseem Env...

CVE-2026-18561 Unlimited Elements For Elementor <= 2.0.16 - Unauthenticated SQL Injection

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, and including, 2.0.16. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query in...

EUVD-2026-75932

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, and including, 2.0.16. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query in...

CVE-2026-18561 Unlimited Elements For Elementor <= 2.0.16 - Unauthenticated SQL Injection

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, and including, 2.0.16. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query in...

CVE-2026-18561

Unlimited Elements For Elementor (Free Widgets, Addons, Templates) for WordPress is vulnerable to unauthenticated SQL injection in versions up to and including 2.0.16 . The flaw resides in the addontype parameter: when supplied as an array, element zero is used verbatim as a SQL comparison operat...

CVE-2026-15462

CVE-2026-15462 affects the Sticky Chat Widget WordPress plugin in versions up to and including 1.4.2 . The vulnerability is an unauthenticated SQL injection via the scw_form_fields parameter array keys in the scw_save_form_data AJAX action. The save_form_data() function passes attacker-controlled...

CVE-2026-15462 Sticky Chat Widget <= 1.4.2 - Unauthenticated SQL Injection

The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scwformfields' parameter array keys of the 'scwsaveformdata' AJAX action in versions up to, and including, 1.4.2. This is due to the saveformdata function passing attacker-controlled POST array keys unsanitized to...

CVE-2026-15462 Sticky Chat Widget <= 1.4.2 - Unauthenticated SQL Injection

The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scwformfields' parameter array keys of the 'scwsaveformdata' AJAX action in versions up to, and including, 1.4.2. This is due to the saveformdata function passing attacker-controlled POST array keys unsanitized to...

EUVD-2026-75954

The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scwformfields' parameter array keys of the 'scwsaveformdata' AJAX action in versions up to, and including, 1.4.2. This is due to the saveformdata function passing attacker-controlled POST array keys unsanitized to...

EUVD-2026-76701

SQL Injection vulnerability in Woltlab WCF v.6.2.4 and before allows a remote attacker to updateUserOptions in UserEditor.class.php and the update action in UserAction.class.php...

CVE-2026-52630

A SQL Injection vulnerability exists in Woltlab WCF version 6.2.4 and before . The flaw allows a remote attacker to target the updateUserOptions function within UserEditor.class.php and the update action in UserAction.class.php. This vulnerability could lead to unauthorized data access or manipul...

CVE-2026-52630: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection vulnerability in Woltlab WCF v.6.2.4 and before allows a remote attacker to updateUserOptions in UserEditor.class.php and the update action in UserAction.class.php...

CVE-2026-62112: Improper Neutralization of Special Elements used in an SQL Command

Editor SQL Injection in Amelia = 2.4.9 versions...

PT-2026-90595

Name of the Vulnerable Software and Affected Versions Smart Marketing SMS and Newsletters Forms versions prior to 5.1.25 Description This issue is a generic SQL Injection that allows authenticated attackers with subscriber-level access and above to append additional SQL queries to existing ones,...