CVE-2026-95593: Improper Neutralization of Special Elements used in an SQL Command

Editor SQL Injection in Ultimeter = 3.0.8 versions...

CVE-2026-93368: Improper Neutralization of Special Elements used in an SQL Command

The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' Username Parameter in all versions up to, and including, 2.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-94174: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in Email Log = 2.63 versions...

CVE-2026-90901: Improper Neutralization of Special Elements used in an SQL Command

Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0 - The media deletion endpoint administrator/index.php?option=comeasystore&task=media.deleteImage parsed the ids parameter as a comma-separated string and implode...

CVE-2026-95927: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in SourceCodester Online Reviewer Management System 1.0. This affects an unknown function of the file /reviewer0/admins/assessments/pretest/exam-delete.php. Such manipulation of the argument testid leads to sql injection. The attack may be performed from remote. The...

PT-2026-97316

Name of the Vulnerable Software and Affected Versions ManageEngine Applications Manager versions 182000 and earlier Description A low-privileged user can execute unauthorized SQL commands, which may lead to the attainment of administrator privileges and remote code execution RCE, a process where ...

PT-2026-97489

Unauthenticated SQL Injection in Product Filter by WBW = 3.1.7 versions...

CVE-2026-95929: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in iFlytek astron-agent up to 1.0.7. Affected is an unknown function of the file console/backend/commons/src/main/resources/mapper/ChatBotMarketMapper.xml of the component getBotList API endpoint. Executing a manipulation of the argument sortDirection can lead to sq...

PT-2026-97125

Name of the Vulnerable Software and Affected Versions SourceCodester Online Reviewer Management System version 1.0 Description A remote SQL injection is possible due to improper handling of the test id argument within an unknown function in the '/reviewer 0/admins/assessments/pretest/btn...

PT-2026-97349

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description A SQL injection flaw exists that could allow a remote authenticated attacker to obtain sensitive information. SQL injection is a technique...

PT-2026-97457

Contributor SQL Injection in WP EasyCart = 5.9.4 versions...

PT-2026-97514

Name of the Vulnerable Software and Affected Versions Easy Store versions 1.0.0 through 3.0.0 Description An authenticated administrator can perform a SQL Injection through the coupon bulk update task. The issue occurs because the application takes input IDs and directly concatenates them into ra...

Fedora 44 : postgresql16-anonymizer (2026-58a319c686)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-58a319c686 advisory. Upstream changelog: https://gitlab.com/dalibo/postgresqlanonymizer/-/releases - core CVE-2026-19633: Escalation via custom types, operators and...

Fedora 45 : postgresql16-anonymizer (2026-bc7408de42)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-bc7408de42 advisory. Upstream changelog: https://gitlab.com/dalibo/postgresqlanonymizer/-/releases - core CVE-2026-19633: Escalation via custom types, operators and...

CVE-2026-96604: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in SoftNews Media Group DataLife Engine 18.0. This affects the function stripdata of the file engine/modules/search.php of the component Search Module. The manipulation of the argument story leads to sql injection. The attack can be initiated remotely. The exploit i...

PT-2026-97513

Name of the Vulnerable Software and Affected Versions Easy Store versions 1.0.0 through 3.0.0 Description Two distinct issues exist in the extension. First, the endpoint 'administrator/index.php?option=com easystore&task=media.deleteImage' fails to properly sanitize the ids parameter, which is...

PT-2026-97487

Editor SQL Injection in Ultimeter = 3.0.8 versions...

PT-2026-97459

Administrator SQL Injection in Email Log = 2.63 versions...

PT-2026-97445

Contributor SQL Injection in Live Copy Paste for Elementor = 1.5.10 versions...

PT-2026-97624

Name of the Vulnerable Software and Affected Versions pmTicket Project-Management-Software versions up to 078fa56a782490c5059a0814f84df27984f4d7e2 Description A remote SQL injection is possible due to improper handling of the conn settings argument within the setSync function of the '/ajax/add...