CVE-2026-15993: Improper Neutralization of Special Elements used in an SQL Command

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via 'username' Placeholder in Dynamic-Choice Field WHERE Clause in all versions up to, and including, 1.15.44 due to insufficient escaping on the user supplied...

PT-2026-73065

Name of the Vulnerable Software and Affected Versions code-projects Online Shopping System version 1.0 Description A remote SQL injection exists within the Login component in the /login.php endpoint. The issue occurs when the email argument is manipulated, allowing an attacker to interfere with t...

CVE-2026-15162: Improper Neutralization of Special Elements used in an SQL Command

The Object Sync for Salesforce plugin is vulnerable to unauthenticated SQL Injection via the wordpressobjecttype parameter of its /wp-json/object-sync-for-salesforce/push/ REST route. The route's permission callback canprocess checks only the HTTP method for the push class — no capability or nonc...

CVE-2026-12248: Improper Neutralization of Special Elements used in an SQL Command

The WPML Multilingual CMS plugin for WordPress is vulnerable to SQL Injection via the 'sorting' parameter in all versions up to, and including, 4.9.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible fo...

CVE-2026-19894: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /viewmedicine.php. Performing a manipulation of the argument delid results in sql injection. The attack can be initiated remotely. The exploit has been released to the...

CVE-2026-16146: Improper Neutralization of Special Elements used in an SQL Command

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to generic SQL Injection via Pattern JSON Keys/Values in all versions up to, and including, 5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation...

CVE-2026-19917: Improper Neutralization of Special Elements used in an SQL Command

A flaw has been found in code-projects Online Food Order System 1.0. The impacted element is an unknown function of the file deletefooditems1.php. Executing a manipulation of the argument checkbox can lead to sql injection. The attack can be executed remotely. The exploit has been published and m...

CVE-2026-19905: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in Jinher OA 1.0. Impacted is an unknown function of the file /C6/JHSoft.Web.HrmAttendance/attendanceoutapprove.aspx. This manipulation of the argument httpOID causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available ...

CVE-2026-18387: Improper Neutralization of Special Elements used in an SQL Command

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'tagquery' parameter in all versions up to, and including, 4.5.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2026-16094: Improper Neutralization of Special Elements used in an SQL Command

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to generic SQL Injection via the 'key' parameter in all versions up to, and including, 5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...

CVE-2026-16080: Improper Neutralization of Special Elements used in an SQL Command

The Image Uploader for Welcart plugin for WordPress is vulnerable to generic SQL Injection via the 'posttitle' parameter in all versions up to, and including, 1.4.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...

PT-2026-72151

Name of the Vulnerable Software and Affected Versions KiviCare – Clinic & Patient Management System EHR versions prior to 4.5.2 Description An issue exists where authenticated attackers with custom-level access and above can perform a generic SQL Injection. This occurs due to insufficient escapin...

PT-2026-72154

Name of the Vulnerable Software and Affected Versions Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms versions prior to 5.2 Description This issue is a generic SQL Injection, which occurs when an application fails to properly sanitize user input, allowing an attacker to...

PT-2026-72157

Name of the Vulnerable Software and Affected Versions The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress versions prior to 30.0.8 Description An issue exists where authenticated attackers with author-level access and above can perform a Second-Order...

PT-2026-72160

Name of the Vulnerable Software and Affected Versions AppFlowy affected versions not specified Description The qcuiknote feature allows authenticated users to perform a SQL injection, which is a technique used to insert malicious SQL statements into entry fields for execution. This allows an...

PT-2026-73039

Name of the Vulnerable Software and Affected Versions SourceCodester Class and Exam Timetabling System version 1.0 Description A remote SQL injection is possible due to improper handling of the ID argument within an unknown function in the /edit teacher.php file. SQL injection is a technique wher...

PT-2026-73043

Name of the Vulnerable Software and Affected Versions SourceCodester Online Clothing Store version 1.0 Description An issue exists within the SQL Database Backup component, specifically affecting the /db/shopping.sql file. This flaw allows remote attackers to access files or directories through...

PT-2026-73066

Name of the Vulnerable Software and Affected Versions code-projects Online Shopping System version 1.0 Description A remote SQL injection is possible due to improper handling of the proId argument within an unknown function in the '/action.php' endpoint. SQL injection is a technique where an...

CVE-2026-16007: Improper Neutralization of Special Elements used in an SQL Command

AppFlowy's qcuiknote feature is affected by a SQL injection vulnerability. Authenticated users with access to the feature can inject arbitrary SQL to exfiltrate data in the underlying SQL database...

PT-2026-72887

Name of the Vulnerable Software and Affected Versions WPML Multilingual CMS versions prior to 4.9.6 Description Insufficient escaping of user-supplied input and lack of proper preparation in SQL queries allow authenticated attackers with translator-level access or higher to perform SQL Injection...