264950 matches found
CVE-2026-111106 Mail Mint <= 1.31.4 - Authenticated (Custom+) SQL Injection via 'filters' Parameter
The Mail Mint plugin for WordPress is vulnerable to SQL Injection via the 'filters' parameter of the /wp-json/mrm/v1/segments/contacts REST endpoint in versions up to, and including, 1.31.4 This is due to insufficient escaping on the user supplied filter 'value' before it is appended to a SQL que...
CVE-2026-93953
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field second-order, via restore in all versions up to, and including, 1.5.8 due to insufficient escaping on the user supplied parameter and the lack of sufficient...
AZL-109535 CVE-2026-111444 affecting package python-wheel 0.43.0-2
Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled NOBACKSLASHESCAPES absent when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and IN lists, and positions in developer-written where strings th...
CVE-2026-111444
Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled NOBACKSLASHESCAPES absent when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and IN lists, and positions in developer-written where strings th...
CVE-2026-103518
The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to generic SQL Injection via the 'products.variants.' parameter in all versions up to, and including, 1.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...
CVE-2026-103518 FluentCart A New Era of eCommerce <= 1.7.0 - Authenticated (Administrator+) SQL Injection via 'products.variants' Array Keys
The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to generic SQL Injection via the 'products.variants.' parameter in all versions up to, and including, 1.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...
EUVD-2026-102611
The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to generic SQL Injection via the 'products.variants.' parameter in all versions up to, and including, 1.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...
CVE-2026-93953 Backuply <= 1.5.8 - Authenticated (Subscriber+) Second-Order SQL Injection via Restore to Privilege Escalation
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field second-order, via restore in all versions up to, and including, 1.5.8 due to insufficient escaping on the user supplied parameter and the lack of sufficient...
CVE-2026-93953 Backuply <= 1.5.8 - Authenticated (Subscriber+) Second-Order SQL Injection via Restore to Privilege Escalation
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field second-order, via restore in all versions up to, and including, 1.5.8 due to insufficient escaping on the user supplied parameter and the lack of sufficient...
CVE-2026-93953
The Backuply WordPress plugin (versions
EUVD-2026-102613
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field second-order, via restore in all versions up to, and including, 1.5.8 due to insufficient escaping on the user supplied parameter and the lack of sufficient...
CVE-2026-103518
The FluentCart WordPress plugin (versions up to and including 1.7.0 ) is vulnerable to a generic SQL Injection flaw. The root cause is insufficient escaping of user-supplied parameters and a lack of sufficient preparation on existing SQL queries involving the 'products[*].variants[*].' parameter....
CVE-2026-103518 FluentCart A New Era of eCommerce <= 1.7.0 - Authenticated (Administrator+) SQL Injection via 'products.variants' Array Keys
The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to generic SQL Injection via the 'products.variants.' parameter in all versions up to, and including, 1.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...
CVE-2026-111444
Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled NOBACKSLASHESCAPES absent when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and IN lists, and positions in developer-written where strings th...
EUVD-2026-102606
Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled NOBACKSLASHESCAPES absent when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and IN lists, and positions in developer-written where strings th...
CVE-2026-111444
Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled NOBACKSLASHESCAPES absent when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and IN lists, and positions in developer-written where strings th...
CVE-2026-111444
Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled NOBACKSLASHESCAPES absent when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and IN lists, and positions in developer-written where strings th...
CVE-2026-111444
Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled NOBACKSLASHESCAPES absent when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and IN lists, and positions in developer-written where strings th...
CVE-2026-111444
The Wheels library versions through 4.1.2 is vulnerable to SQL injection when used with MySQL/MariaDB databases that have backslash escaping enabled (missing NO_BACKSLASH_ESCAPES). The root cause is that doubling single quotes without accounting for backslash escapes allows an attacker to alter q...
CVE-2026-111389
Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to these endpoints to extra...