CVE-2026-19944: Improper Neutralization of Special Elements used in an SQL Command

The WP Crowdfunding plugin for WordPress is vulnerable to generic SQL Injection via 'wpneoreward' Post Meta in all versions up to, and including, 2.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CSP log - Critical - SQL Injection - SA-CONTRIB-2026-136

The CSP Log module enhances any module that adds the CSP header to a site, by providing a reporting endpoint, custom storage, and aggregated reports that can be used to trace issues or adapt the CSP headers. The module did not sufficiently sanitize user-supplied values used in database queries,...

CVE-2026-84068: Improper Neutralization of Special Elements used in an SQL Command

The Quentn WP WordPress plugin before 1.2.15 does not adequately escape a request parameter before using it in an unprepared SQL query, allowing unauthenticated attackers to extract arbitrary data from the database via SQL injection...

CVE-2026-19800: Improper Neutralization of Special Elements used in an SQL Command

The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to SQL Injection via the 'status' parameter in all versions up to, and including, 1.31.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-67401: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component...

cPanel EmailTrack CVE-2026-67401 Scanner / Mitigation

This toolkit provides detection and mitigation utilities for CVE-2026-67401, a SQL injection vulnerability affecting the cPanel and WHM EmailTrack functionality. The included scanner checks the installed cPanel version and package integrity, searches system and database logs for suspicious...

CVE-2026-79640: Improper Neutralization of Special Elements used in an SQL Command

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this...

CVE-2026-71808

A SQL Injection vulnerability exists in Siam Ordering (siam-server) 1.0.0 . The flaw is caused by the use of ${} string concatenation within AdminMapper.java and several other Mapper files, such as MerchantWithdrawRecordMapper.java and MemberWithdrawRecordMapper.java . This allows remote authenti...

PT-2026-88893

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this...

PT-2026-88901

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this...

CVE-2026-80177: Improper Neutralization of Special Elements used in an SQL Command

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this...

PT-2026-88776

Tanium addressed a SQL injection vulnerability in Comply...

CVE-2026-79387: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in PbootCMS versions 3.2.0 through 3.2.5 allows an authenticated user to modify arbitrary user account fields including passwords and roles via crafted parameters to the User/mod interface, enabling account takeover...

PT-2026-89153

A SQL Injection vulnerability in Siam Ordering siam-server 1.0.0 allows remote authenticated attackers to execute arbitrary SQL commands via the $ string concatenation in AdminMapper.java and multiple other Mapper files including MerchantWithdrawRecordMapper.java and MemberWithdrawRecordMapper.ja...

PT-2026-88857

The ELEX WooCommerce Request a Quote WordPress plugin before 2.4.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks and extract arbitrary data from the database...

PT-2026-88872

The Quentn WP WordPress plugin before 1.2.15 does not properly sanitise and escape a parameter before using it in an SQL query, allowing high privilege users such as administrators to perform SQL injection attacks...

PT-2026-88871

Name of the Vulnerable Software and Affected Versions Quentn WP versions prior to 1.2.15 Description Unauthenticated attackers can extract arbitrary data from the database through SQL injection. This occurs because the plugin fails to adequately escape request parameters before incorporating them...

PT-2026-88887

The WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping plugin for WordPress is vulnerable to time-based SQL Injection via the 'feed' parameter in all versions up to, and including, 2.23.7 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-87808: Protection Mechanism Failure

SiYuan versions = 3.8.1 contain an incomplete fix for CVE-2026-32767 GHSA-j7wh-x834-p3r7. The prior fix commit d5e2d0bc added an administrator check for SQL mode method=2 in POST /api/search/fullTextSearchBlock, but the endpoint still does not enforce the application's read-only boundary: for...

CVE-2026-84113: Improper Neutralization of Special Elements used in an SQL Command

The Quentn WP WordPress plugin before 1.2.15 does not properly sanitise and escape a parameter before using it in an SQL query, allowing high privilege users such as administrators to perform SQL injection attacks...