CVE-2026-15462 Sticky Chat Widget <= 1.4.2 - Unauthenticated SQL Injection

The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scwformfields' parameter array keys of the 'scwsaveformdata' AJAX action in versions up to, and including, 1.4.2. This is due to the saveformdata function passing attacker-controlled POST array keys unsanitized to...

CVE-2026-15462

CVE-2026-15462 affects the Sticky Chat Widget WordPress plugin in versions up to and including 1.4.2 . The vulnerability is an unauthenticated SQL injection via the scw_form_fields parameter array keys in the scw_save_form_data AJAX action. The save_form_data() function passes attacker-controlled...

EUVD-2026-75954

The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scwformfields' parameter array keys of the 'scwsaveformdata' AJAX action in versions up to, and including, 1.4.2. This is due to the saveformdata function passing attacker-controlled POST array keys unsanitized to...

PT-2026-90593

Name of the Vulnerable Software and Affected Versions rtMedia for WordPress, BuddyPress and bbPress versions prior to 4.7.12 Description The plugin is subject to time-based blind SQL Injection, a technique where an attacker asks the database true/false questions and determines the answer based on...

SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37989)

Sales and Inventory System is a business resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability, which stems from the improper validation of the companyname parameter in the /pages/suptransac.php file...

CVE-2026-72708: Improper Neutralization of Special Elements used in an SQL Command

SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the SQL escaping layer that allows unauthenticated attackers to inject arbitrary SQL by supplying a crafted annee parameter value matching a word character followed by an open parenthesis, which bypasses escaping...

PT-2026-89895

The GamiPress plugin for WordPress is vulnerable to authenticated Subscriber+ SQL Injection via the 'q' parameter of the wpForo integration AJAX selector action gamipress wpforo get posts in versions up to, and including, 7.9.7. The value is passed only through $wpdb-esc like and interpolated...

CVE-2026-52630: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection vulnerability in Woltlab WCF v.6.2.4 and before allows a remote attacker to updateUserOptions in UserEditor.class.php and the update action in UserAction.class.php...

PT-2026-89911

Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.4.18 Description An unauthenticated blind SQL injection exists in the SQL escaping layer. This issue allows attackers to inject arbitrary SQL by providing a crafted annee parameter value consisting of a word character...

CVE-2026-62112: Improper Neutralization of Special Elements used in an SQL Command

Editor SQL Injection in Amelia = 2.4.9 versions...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS : PHP vulnerabilities (USN-8743-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8743-1 advisory. It was discovered that PHP incorrectly handled backslash escaping in the...

SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37986)

Sales and Inventory System is an enterprise resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability, which stems from the failure to properly validate the ID parameter in the /pages/settings Edit.php...

CVE-2026-62109: Improper Neutralization of Special Elements used in an SQL Command

Editor SQL Injection in Sky Addons for Elementor = 3.8.4 versions...

PT-2026-90024

Editor SQL Injection in Sky Addons for Elementor = 3.8.4 versions...

CVE-2026-52630

A SQL Injection vulnerability exists in Woltlab WCF version 6.2.4 and before . The flaw allows a remote attacker to target the updateUserOptions function within UserEditor.class.php and the update action in UserAction.class.php. This vulnerability could lead to unauthorized data access or manipul...

EUVD-2026-76701

SQL Injection vulnerability in Woltlab WCF v.6.2.4 and before allows a remote attacker to updateUserOptions in UserEditor.class.php and the update action in UserAction.class.php...

VulnCheck KEV: CVE-2017-8917

SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2026-15462: Improper Neutralization of Special Elements used in an SQL Command

The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scwformfields' parameter array keys of the 'scwsaveformdata' AJAX action in versions up to, and including, 1.4.2. This is due to the saveformdata function passing attacker-controlled POST array keys unsanitized to...

CVE-2026-52630

SQL Injection vulnerability in Woltlab WCF v.6.2.4 and before allows a remote attacker to updateUserOptions in UserEditor.class.php and the update action in UserAction.class.php...

CVE-2026-82583: Improper Neutralization of Special Elements used in an SQL Command

NextGen Connect Mirth Connect versions 4.7.1 and earlier allow an authenticated user to execute arbitrary SQL through a Database Connector API, which could result in disclosure of stored credentials for connected systems, arbitrary file write, and a denial-of-service condition...