CVE-2026-116218 Dolibarr ERP CRM 19.0.0 before 23.0.4 SQL Injection via bankaccounts API type field

Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-party bankaccounts REST endpoint. Attackers with only societe/creer permission can break out of the unescaped type value in...

CVE-2026-116218 Dolibarr ERP CRM 19.0.0 before 23.0.4 SQL Injection via bankaccounts API type field

Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-party bankaccounts REST endpoint. Attackers with only societe/creer permission can break out of the unescaped type value in...

EUVD-2026-109810

Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-party bankaccounts REST endpoint. Attackers with only societe/creer permission can break out of the unescaped type value in...

WordPress Advanced Ads – Tracking plugin < 4.0.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by dutafi in WordPress Plugin Advanced Ads – Tracking versions 4.0.0...

CVE-2026-115192

An SQL Injection vulnerability exists in the dashboard widget data API endpoint /api/data/type. Chart filter parameters supplied by the client are not properly validated before they are used in the database queries that build dashboard chart data. An authenticated user with API access can exploit...

EUVD-2026-109796

An SQL Injection vulnerability exists in the dashboard widget data API endpoint /api/data/type. Chart filter parameters supplied by the client are not properly validated before they are used in the database queries that build dashboard chart data. An authenticated user with API access can exploit...

CVE-2026-115192

An SQL Injection vulnerability exists in the dashboard widget data API endpoint /api/data/type. Chart filter parameters supplied by the client are not properly validated before they are used in the database queries that build dashboard chart data. An authenticated user with API access can exploit...

CVE-2026-115192

An SQL Injection vulnerability exists in the dashboard widget data API endpoint /api/data/type. Chart filter parameters supplied by the client are not properly validated before they are used in the database queries that build dashboard chart data. An authenticated user with API access can exploit...

CVE-2026-115192

An SQL Injection vulnerability exists in the Mautic dashboard widget data API endpoint (/api/data/{type}). The root cause is the improper validation of client-supplied chart filter parameters before they are used in database queries. An authenticated user with API access can leverage blind SQL in...

CVE-2026-115192

An SQL Injection vulnerability exists in the dashboard widget data API endpoint /api/data/type. Chart filter parameters supplied by the client are not properly validated before they are used in the database queries that build dashboard chart data. An authenticated user with API access can exploit...

CVE-2026-115191

A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface /s/ajax. A request parameter that selects the contact field to search by is not properly validated before it is used in a database query. Any authenticated Mautic user can exploit this,...

CVE-2026-115191

A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface /s/ajax. A request parameter that selects the contact field to search by is not properly validated before it is used in a database query. Any authenticated Mautic user can exploit this,...

EUVD-2026-109794

A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface /s/ajax. A request parameter that selects the contact field to search by is not properly validated before it is used in a database query. Any authenticated Mautic user can exploit this,...

CVE-2026-115191

A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface /s/ajax. A request parameter that selects the contact field to search by is not properly validated before it is used in a database query. Any authenticated Mautic user can exploit this,...

CVE-2026-115191

A SQL injection vulnerability exists in the contact lookup AJAX endpoint (/s/ajax) of the Mautic administration interface. The root cause is a failure to properly validate a request parameter used to select the contact field for database queries. This flaw allows any authenticated Mautic user , r...

CVE-2026-115191

A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface /s/ajax. A request parameter that selects the contact field to search by is not properly validated before it is used in a database query. Any authenticated Mautic user can exploit this,...

WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ayukiab in WordPress Plugin BuddyPress versions = 14.5.2...

WordPress FunnelKit Automations plugin <= 3.8.5.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by AndrewN in WordPress Plugin FunnelKit Automations versions = 3.8.5.2...

WordPress DXP ToolKit plugin <= 2.0.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by V1T in WordPress Plugin DXP ToolKit versions = 2.0.1...

frevvomapexec

frevvomapexec frevvomapexec is a script to verify the existence of a blind SQL injection vulnerability by injecting a delay of your choosing in seconds in Square 9 GlobalForms 6.2. To verify the vulnerability is legitimate, the end user will be required to do math e.g. Subtracting the smaller...