265165 matches found
PT-2026-110062
Name of the Vulnerable Software and Affected Versions WP Verify API versions prior to 1.0.1 Description Unauthenticated users can perform SQL injection attacks because the plugin fails to properly sanitize and escape the verify parameter before incorporating it into a SQL query. SQL injection is ...
CVE-2026-81420: Improper Neutralization of Special Elements used in an SQL Command
The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it in a SQL statement in one of its unauthenticated AJAX actions, allowing unauthenticated users to perform SQL injection attacks...
Exploit for CVE-2026-102428
CVE-2026-102428 — OrdaSoft OS CCK comoscck unauthenticated...
CVE-2026-62117
Subscriber SQL Injection in Barcode Scanner with Inventory & Order Manager = 1.13.1 versions...
CVE-2026-62031
Unauthenticated SQL Injection in uListing = 2.2.0 versions...
CVE-2026-42722
Administrator SQL Injection in Frontend Admin by DynamiApps = 3.29.13 versions...
CVE-2026-45440
Administrator SQL Injection in WP Ultimate CSV Importer = 9.2 versions...
CVE-2026-42717
Administrator SQL Injection in Leyka = 3.32.3 versions...
CVE-2026-42712
Subscriber SQL Injection in Qode Tours = 3.1.3.2 versions...
CVE-2026-42633
Subscriber SQL Injection in Events Manager = 7.4.6 versions...
CVE-2026-40800
Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes = 1.5.3 versions...
CVE-2026-108604
Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP runquery safety gate that allows prompt-injected agents or untrusted MCP clients to bypass read-only mode by submitting side-effecting SELECT statements. Attackers can run statements like SELECT setval, nextval,...
CVE-2026-108604 Tabularis through 0.27.0 Read-Only Bypass via MCP run_query SELECT Classification
Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP runquery safety gate that allows prompt-injected agents or untrusted MCP clients to bypass read-only mode by submitting side-effecting SELECT statements. Attackers can run statements like SELECT setval, nextval,...
CVE-2026-62117
The WordPress Barcode Scanner with Inventory & Order Manager plugin (versions
EUVD-2026-96505
Subscriber SQL Injection in Barcode Scanner with Inventory & Order Manager = 1.13.1 versions...
CVE-2026-62117 WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - SQL Injection vulnerability
Subscriber SQL Injection in Barcode Scanner with Inventory & Order Manager = 1.13.1 versions...
CVE-2026-62117 WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - SQL Injection vulnerability
Subscriber SQL Injection in Barcode Scanner with Inventory & Order Manager = 1.13.1 versions...
CVE-2026-62031 WordPress uListing plugin <= 2.2.0 - SQL Injection vulnerability
Unauthenticated SQL Injection in uListing = 2.2.0 versions...