PT-2026-73120

The WP Directory Kit WordPress plugin before 1.5.7 does not sanitise and escape a parameter before using it in a SQL statement, allowing administrators to perform SQL injection attacks. On a multisite installation this lets an administrator of a single site read data belonging to the entire...

PT-2026-73115

Name of the Vulnerable Software and Affected Versions User Login History versions prior to 2.1.8 Description The User Login History plugin for WordPress contains a SQL Injection flaw, which occurs when an application fails to properly sanitize or escape input used in a database query, allowing an...

PT-2026-73112

Name of the Vulnerable Software and Affected Versions Slider Hero versions prior to 9.1.8 Description An issue exists where authenticated attackers with administrator-level access can perform a second-order SQL Injection. While slide data such as description, title, btn, btn2, image link, and...

PT-2026-73106

Name of the Vulnerable Software and Affected Versions WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors versions prior to 2.7.1 Description An issue exists where authenticated attackers with shop manager-level access or higher can perform a generic SQL Injection. This...

PT-2026-73094

Name of the Vulnerable Software and Affected Versions Fullscreen Galleria versions prior to 1.6.13 Description The Fullscreen Galleria plugin for WordPress contains a SQL Injection flaw. This occurs because of insufficient escaping of user-supplied parameters and a lack of proper preparation of t...

PT-2026-73091

Name of the Vulnerable Software and Affected Versions NEX-Forms – Ultimate Forms Plugin for WordPress versions prior to 9.2.5 Description This is a second-order SQL Injection issue where an attacker can append additional SQL queries to existing ones to extract sensitive database information. The...

CVE-2026-19925: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in SourceCodester Stock Management System 1.0. This issue affects some unknown processing of the file /classes/Master.php?f=deletesupplier. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit is now public and...

CVE-2026-19919: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in code-projects Online Shopping System 1.0. This impacts an unknown function of the file /login.php of the component Login. The manipulation of the argument email results in sql injection. The attack may be performed from remote. The exploit has been made public and cou...

PT-2026-73150

Name of the Vulnerable Software and Affected Versions Phoca Cart versions 5.0.0 through 6.1.16 Description An unauthenticated attacker can perform a SQL injection on the public shop items page. The issue occurs because the GET array parameters a attribute and s specification are concatenated...

PT-2026-73093

Name of the Vulnerable Software and Affected Versions Quiz and Survey Master QSM – Easy Quiz and Survey Maker versions prior to 11.2.2 Description The plugin is subject to a generic SQL Injection, a technique where malicious SQL statements are inserted into entry fields for execution. This occurs...

CVE-2026-9767: Improper Neutralization of Special Elements used in an SQL Command

The The School Management – Education & Learning ERP plugin for WordPress is vulnerable to generic SQL Injection via 'order0dir' Parameter in all versions up to, and including, 5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-19920

A vulnerability was determined in code-projects Online Shopping System 1.0. Affected is an unknown function of the file /action.php. This manipulation of the argument proId causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be...

CVE-2026-19920

CVE-2026-19920 affects the code-projects Online Shopping System 1.0. The vulnerability targets the function in the file /action.php , where manipulating the argument proId leads to a SQL injection . The issue is exploitable remotely, and public disclosure has occurred (exploit maturity: PROOF-OF-...

CVE-2026-19920 code-projects Online Shopping System action.php sql injection

A vulnerability was determined in code-projects Online Shopping System 1.0. Affected is an unknown function of the file /action.php. This manipulation of the argument proId causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be...

CVE-2026-19920 code-projects Online Shopping System action.php sql injection

A vulnerability was determined in code-projects Online Shopping System 1.0. Affected is an unknown function of the file /action.php. This manipulation of the argument proId causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be...

CVE-2026-19919 code-projects Online Shopping System Login login.php sql injection

A vulnerability was found in code-projects Online Shopping System 1.0. This impacts an unknown function of the file /login.php of the component Login. The manipulation of the argument email results in sql injection. The attack may be performed from remote. The exploit has been made public and cou...

CVE-2026-19919

A vulnerability was found in code-projects Online Shopping System 1.0. This impacts an unknown function of the file /login.php of the component Login. The manipulation of the argument email results in sql injection. The attack may be performed from remote. The exploit has been made public and cou...

CVE-2026-19919

CVE-2026-19919 affects code-projects Online Shopping System 1.0, specifically the Login component’s login.php where manipulation of the email parameter causes SQL injection. At risk is remote exploitation with public exploits reported; CVSS scores (3.0/3.1/4.0/2.0) indicate high/medium severity v...

CVE-2026-19919 code-projects Online Shopping System Login login.php sql injection

A vulnerability was found in code-projects Online Shopping System 1.0. This impacts an unknown function of the file /login.php of the component Login. The manipulation of the argument email results in sql injection. The attack may be performed from remote. The exploit has been made public and cou...

CVE-2026-19917

A flaw has been found in code-projects Online Food Order System 1.0. The impacted element is an unknown function of the file deletefooditems1.php. Executing a manipulation of the argument checkbox can lead to sql injection. The attack can be executed remotely. The exploit has been published and m...