CVE-2026-84097 WP Review Slider Pro < 12.7.12 - Subscriber+ SQLi via Stored Template Filter

The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a value stored through one of its AJAX handlers, which lacks a capability check, before using it in a SQL statement, allowing any authenticated user, such as a subscriber, to perform SQL injection attacks whose results are...

CVE-2026-84097

The wp-review-slider-pro WordPress plugin (versions before 12.7.12 ) is vulnerable to SQL injection . The root cause is a failure to sanitize a value stored via an AJAX handler that lacks a proper capability check. This allows any authenticated user , such as a subscriber, to perform SQL injectio...

EUVD-2026-87533

The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a value stored through one of its AJAX handlers, which lacks a capability check, before using it in a SQL statement, allowing any authenticated user, such as a subscriber, to perform SQL injection attacks whose results are...

CVE-2026-84097 WP Review Slider Pro < 12.7.12 - Subscriber+ SQLi via Stored Template Filter

The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a value stored through one of its AJAX handlers, which lacks a capability check, before using it in a SQL statement, allowing any authenticated user, such as a subscriber, to perform SQL injection attacks whose results are...

CVE-2026-89237 Bluff Post <= 1.1.1 - Unauthenticated SQLi via 'table_name' and 'column_name' Parameters

The Bluff Post WordPress plugin through 1.1.1 does not sanitise and escape parameters before using them as identifiers in a SQL query, allowing unauthenticated attackers to append additional SQL and extract sensitive information from the database...

CVE-2026-89237

The Bluff Post WordPress plugin (versions through 1.1.1 ) is vulnerable to an unauthenticated SQL injection . The root cause is the failure to sanitize and escape parameters—specifically the 'table_name' and 'column_name' parameters—before using them as identifiers in a SQL query. This allows an ...

CVE-2026-89237 Bluff Post <= 1.1.1 - Unauthenticated SQLi via 'table_name' and 'column_name' Parameters

The Bluff Post WordPress plugin through 1.1.1 does not sanitise and escape parameters before using them as identifiers in a SQL query, allowing unauthenticated attackers to append additional SQL and extract sensitive information from the database...

EUVD-2026-87527

The Bluff Post WordPress plugin through 1.1.1 does not sanitise and escape parameters before using them as identifiers in a SQL query, allowing unauthenticated attackers to append additional SQL and extract sensitive information from the database...

Exploit for SQL Injection in Strapi

abraxaslabs.tech · github.com/abraxas ·&...

CVE-2026-14962

CVE-2026-14962 WordPress 插件 ELEX WooCommerce Request a Quote 未认证 SQL 注入 ELEX WooCommerce Request a Quote（WordPress 插件 elex-request-a-quote）≤ 2.4.0 — 通过公开的 elexraqaddtoquote AJAX 操作实现未认证 SQL 注入。 仅限授权测试。请勿对您不拥有或未获授权测试的系统运行此工具。 要求： Python 3，仅使用标准库。目标必须运行 WooCommerce（报价脚本/nonce 会打印在商店/首页上）。 python3...

PT-2026-99269

Name of the Vulnerable Software and Affected Versions CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be Description A remote SQL injection is possible due to the improper handling of the eno argument within the updatedetailsfromstudent.php file. SQL injection is a...

PT-2026-99270

Name of the Vulnerable Software and Affected Versions CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be Description A remote SQL injection exists in the file mydetailsfaculty.php. The issue occurs when the myfid argument is manipulated, allowing an attacker to...

PT-2026-99244

Name of the Vulnerable Software and Affected Versions wp-review-slider-pro versions prior to 12.7.12 Description An issue exists where a value stored through an AJAX handler is not sanitized before being used in a SQL statement. The handler also lacks a capability check, which allows any...

CVE-2026-94130: Improper Neutralization of Special Elements used in an SQL Command

Joomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gallery extension 5.7.3 - An SQL injection vulnerability in video search functionality and sorting allowed attackers to inject SQL commands in read queries...

CVE-2026-97162: Improper Neutralization of Special Elements used in an SQL Command

Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29...

PT-2026-99315

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.4 Description An issue exists in the graph query endpoint where the dailyNoteSavePath parameter is concatenated into a SQL query without proper escaping. This allows unauthenticated attackers on published sites wit...

CVE-2026-100312: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function of the file /updateguest.php. Performing a manipulation of the argument gname/editassid results in sql injection. It is possib...

PT-2026-99397

Name of the Vulnerable Software and Affected Versions UP plugin extension versions 5.0.0 through 5.2.0 UP plugin extension versions 6.0.0 through 6.0.29 Description The UP plugin extension contains multiple SQL injection vectors. SQL injection is a type of vulnerability that allows an attacker to...

PT-2026-99246

Name of the Vulnerable Software and Affected Versions Bluff Post WordPress plugin versions prior to 1.1.2 Description Insufficient sanitization and escaping of parameters used as identifiers in a SQL query allow unauthenticated attackers to append additional SQL commands. This can lead to the...

CVE-2026-84097: Improper Neutralization of Special Elements used in an SQL Command

The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a value stored through one of its AJAX handlers, which lacks a capability check, before using it in a SQL statement, allowing any authenticated user, such as a subscriber, to perform SQL injection attacks whose results are...