CVE-2026-19680: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability exists in Security Center that could allow an attacker to access unauthorized data from the application's database...

CVE-2026-12743: Improper Neutralization of Special Elements used in an SQL Command

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient...

PT-2026-72070

A SQL injection vulnerability exists in Security Center that could allow an attacker to access unauthorized data from the application's database...

PT-2026-72086

Name of the Vulnerable Software and Affected Versions LimeSurvey Community Edition version 7.0.5 Description An authenticated SQL injection exists in the Central Participant Database CPDB workflow. This issue occurs during the process of copying survey participant tokens to the central participan...

PT-2026-71938

A vulnerability was identified in Raisecom Communication Command and Dispatch Management Platform up to 7.6.5. This affects an unknown part of the file /app/users/getpwd.php. Such manipulation of the argument sip leads to sql injection. The attack can be executed remotely. The exploit is publicly...

PT-2026-71964

Name of the Vulnerable Software and Affected Versions Bit Form versions prior to 3.2.1 Description The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress contains a generic SQL Injection flaw. This occurs because the plugin fails to...

CVE-2026-71571: Improper Neutralization of Special Elements used in an SQL Command

Joomla Extension - icagenda.com - Authenticated SQL injection via unescaped numeric filter in iCagenda 2.0.0-4.0.11 - Backend operators with permissions to access iCagenda could inject SQL...

PT-2026-71962

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient...

VulnCheck KEV: CVE-2026-15205

The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows...

PT-2026-71954

A vulnerability was determined in SourceCodester Air Cargo Management System 1.0. Impacted is an unknown function of the file /classes/Master.php?f=save cargo type. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been...

PT-2026-72017

A security vulnerability has been detected in SourceCodester Simple Client Management System 1.0. The impacted element is an unknown function of the file /classes/Master.php?f=save service. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out...

CVE-2026-15205: Improper Neutralization of Special Elements used in an SQL Command

The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows...

CVE-2026-16810: Improper Neutralization of Special Elements used in an SQL Command

The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'dataqueryCondition' parameter in all versions up to, and including, 3.2.0 due to insufficient escaping on the user supplied parameter...

CVE-2026-19787: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in SourceCodester Air Cargo Management System 1.0. Impacted is an unknown function of the file /classes/Master.php?f=savecargotype. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been...

CVE-2026-19631: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability exists in Security Center that could allow an authenticated administrator to execute arbitrary SQL queries, potentially resulting in unauthorized access to sensitive data, including credentials...

CVE-2026-67365: Improper Neutralization of Special Elements used in an SQL Command

Joomla Extension - icagenda.com - Unauthenticated SQL injection in iCagenda 4.0.0-4.0.11 - Unauthenticated SQL injection in modicagendacalendar iCagenda, reachable via comajax with no session, token or account...

CVE-2026-48528: Improper Neutralization of Special Elements used in an SQL Command

Metacat is data repository software that helps researchers preserve, share, and discover data. Metacat versions 2.0.0 through 3.4.0 contain an unauthenticated SQL injection vulnerability in the /cn/v1/object and /cn/v2/object REST API endpoints due to unsanitized user input that can be passed...

CVE-2026-72811: Improper Neutralization of Special Elements used in an SQL Command

SiYuan versions = v3.7.2 contain a SQL injection vulnerability in the backlink/mention search query kernel/model/backlink.go, which concatenates stored block metadata title, name, alias, anchor text and the client-supplied keyword into a SQL MATCH/search statement while escaping only the...

PT-2026-72081

Name of the Vulnerable Software and Affected Versions Metacat versions 2.0.0 through 3.4.0 Description Unauthenticated SQL injection exists in the /cn/v1/object and /cn/v2/object REST API endpoints. The issue occurs because the software appends user-supplied data to SQL queries without sanitizati...

PT-2026-72114

Name of the Vulnerable Software and Affected Versions iCagenda versions prior to 4.0.11 Description An unauthenticated SQL injection exists in the mod icagenda calendar module. This issue is reachable via the com ajax endpoint without requiring a session, token, or account. SQL injection is a...