CVE-2026-104724

The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to generic SQL Injection via FireBox Form Display Condition in all versions up to, and including, 3.1.13 due to insufficient escaping on the user supplied parameter and la...

CVE-2026-104724

The FireBox – WooCommerce Popup Builder plugin for WordPress is vulnerable to a generic SQL Injection in all versions up to and including 3.1.13 . The root cause is insufficient escaping on user-supplied parameters and a lack of sufficient preparation on existing SQL queries within the FireBox Fo...

CVE-2026-104724 FireBox <= 3.1.13 - Authenticated (Author+) SQL Injection via FireBox Form Display Condition

The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to generic SQL Injection via FireBox Form Display Condition in all versions up to, and including, 3.1.13 due to insufficient escaping on the user supplied parameter and la...

EUVD-2026-96066

The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to generic SQL Injection via FireBox Form Display Condition in all versions up to, and including, 3.1.13 due to insufficient escaping on the user supplied parameter and la...

EUVD-2026-96025

In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions...

CVE-2026-108474

In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions...

PT-2026-109780

Name of the Vulnerable Software and Affected Versions Leyka versions prior to 3.32.4 Description An SQL Injection issue exists in the administrator section, allowing an attacker to interfere with the queries that an application makes to its database. Recommendations Update to a version newer than...

CVE-2026-42722: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in Frontend Admin by DynamiApps = 3.29.13 versions...

CVE-2026-40800: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes = 1.5.3 versions...

CVE-2026-45440: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in WP Ultimate CSV Importer = 9.2 versions...

CVE-2026-42712: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Qode Tours = 3.1.3.2 versions...

CVE-2026-42633: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Events Manager = 7.4.6 versions...

CVE-2026-108604: Incorrect Authorization

Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP runquery safety gate that allows prompt-injected agents or untrusted MCP clients to bypass read-only mode by submitting side-effecting SELECT statements. Attackers can run statements like SELECT setval, nextval,...

CVE-2026-105889: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Tickera Tickera tickera-event-ticketing-system allows Blind SQL Injection.This issue affects Tickera: from n/a through 3.6.0.6...

CVE-2026-107712: Improper Neutralization of Special Elements used in an SQL Command

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the 'currentmonth' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-104724: Improper Neutralization of Special Elements used in an SQL Command

The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to generic SQL Injection via FireBox Form Display Condition in all versions up to, and including, 3.1.13 due to insufficient escaping on the user supplied parameter and la...

CVE-2026-104023: Improper Neutralization of Special Elements used in an SQL Command

The Smart Popup by Supsystic plugin for WordPress is vulnerable to generic SQL Injection via the 'sidx' parameter in all versions up to, and including, 1.13.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2026-62117: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Barcode Scanner with Inventory & Order Manager = 1.13.1 versions...

CVE-2026-62031: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in uListing = 2.2.0 versions...

CVE-2026-108474: Improper Neutralization of Special Elements used in an SQL Command

In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions...