PT-2026-109606

The WP Directory Kit plugin for WordPress is vulnerable to time-based SQL Injection via 'display name' Profile Field Second-Order in all versions up to, and including, 1.5.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...

CVE-2026-96662: Improper Neutralization of Special Elements used in an SQL Command

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection via 'bookingserviceid' Parameter in all versions up to, and including, 5.7.2 due to insufficient escaping on the user supplied parameter and lack of...

PT-2026-109607

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection via 'bookingservice id' Parameter in all versions up to, and including, 5.7.2 due to insufficient escaping on the user supplied parameter and lack of...

PT-2026-109534

The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

PT-2026-109798

Name of the Vulnerable Software and Affected Versions uListing versions prior to 2.2.1 Description An unauthenticated SQL Injection exists in the software. SQL Injection is a type of vulnerability that allows an attacker to interfere with the queries that an application makes to its database,...

PT-2026-109787

Name of the Vulnerable Software and Affected Versions WP Ultimate CSV Importer versions prior to 9.3 Description An SQL Injection issue exists that allows an administrator to execute malicious SQL queries. This occurs when the application fails to properly sanitize input used in database queries...

CVE-2026-45440: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in WP Ultimate CSV Importer = 9.2 versions...

CVE-2026-62031: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in uListing = 2.2.0 versions...

CVE-2026-108474

In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions...

CVE-2026-108474

In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions...

CVE-2026-108474

JetBrains Exposed versions prior to 1.5.1 are vulnerable to an SQL injection flaw. The vulnerability stems from unescaped string arguments passed to several SQL functions. This flaw allows an attacker to potentially compromise the integrity, confidentiality, and availability of the database. Reme...

CVE-2026-108474

In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions...

hackazon

Hackazon Hackazon es un sitio de prueba vulnerable gratuito que es una tienda en línea construida con las mismas tecnologías utilizadas en las aplicaciones móviles y de cliente enriquecido actuales. Hackazon tiene una interfaz AJAX, flujos de trabajo estrictos y API RESTful utilizadas por una...

pymap

pymap — SQL injection discovery & exploitation toolkit Two co...

WordPress Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin <= 5.7.2 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by zickzick2 in WordPress Plugin LatePoint versions = 5.7.2...

WordPress WP Directory Kit plugin <= 1.5.9 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Tarcísio Luchesi De Almeida Silva Poystick in WordPress Plugin WP Directory Kit versions = 1.5.9...

AccuKnox-DVWA-Kubernetes

DVWA on Kubernetes — Security Testing Lab 1. Project Overv...

WordPress WP Booking System – Booking Calendar plugin <= 2.1.0.1 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Spy0x7 in WordPress Plugin WP Booking System versions = 2.1.0.1...

WordPress Smart Popup by Supsystic plugin <= 1.13.2 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Popup by Supsystic versions = 1.13.2...

WordPress WP Ultimate CSV Importer SQL Injection Vulnerability

WordPress WP Ultimate CSV Importer 9.2 and earlier versions have a SQL injection vulnerability, which can be exploited by SQL injection attacks...