CVE-2026-16949

CVE-2026-16949 affects the Term Pages WordPress plugin prior to 2.0.0. The vulnerability arises from not properly sanitising and escaping a parameter before constructing a SQL statement, enabling unauthenticated SQL injection. Exploit details and a formal fix/patch version are not provided in the...

CVE-2026-16949 Term Pages < 2.0.0 - Unauthenticated SQL Injection via tp_lookup

The Term Pages WordPress plugin before 2.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks...

CVE-2026-16949

The Term Pages WordPress plugin before 2.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks...

CVE-2026-18666 Library Management System < 3.6.7 - Subscriber+ SQL Injection via Filter Value

The Library Management System WordPress plugin before 3.6.7 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing users with a role as low as Subscriber to perform SQL injection and extract arbitrary data from the database, including user password...

EUVD-2026-55029

The Library Management System WordPress plugin before 3.6.7 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing users with a role as low as Subscriber to perform SQL injection and extract arbitrary data from the database, including user password...

CVE-2026-18666

The CVE-2026-18666 entry affects the Library Management System WordPress plugin prior to version 3.6.7. The vulnerability stems from insufficient sanitization/escaping of a user-supplied parameter used in a SQL statement, enabling SQL injection by users with a role as low as Subscriber. Impact de...

CVE-2026-19384

A weakness has been identified in SourceCodester Simple Doctors Appointment System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=setappointment. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has...

CVE-2026-19384

CVE-2026-19384 affects SourceCodester Simple Doctors Appointment System 1.0. The vulnerability is an SQL injection in the admin/ajax.php?action=set_appointment path, caused by manipulating the argument ID in an unknown function. The issue can be remotely exploitable, and public exploits/PoC are n...

EUVD-2026-54983

A weakness has been identified in SourceCodester Simple Doctors Appointment System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=setappointment. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has...

PT-2026-69889

Name of the Vulnerable Software and Affected Versions Metabase affected versions not specified Description A remote, unauthenticated attacker can perform a SQL injection, which is the insertion of malicious SQL queries into input fields to manipulate a database, via the '/reset password' endpoint...

Photon OS 5.0: Postgresql15 PHSA-2024-5.0-91-0419

An update of the postgresql15 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-91-0419. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Postgresql15 PHSA-2025-5.0-91-0490

An update of the postgresql15 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0490. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Postgresql13 PHSA-2024-5.0-91-0419

An update of the postgresql13 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-91-0419. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

PT-2026-69890

Name of the Vulnerable Software and Affected Versions Metabase affected versions not specified Description An unauthenticated attacker can perform SQL injection by utilizing a publicly shared card or dashboard. The issue occurs when these shared elements expose a field-filter dimension parameter,...

PT-2026-69983

Name of the Vulnerable Software and Affected Versions Mastodon versions prior to 4.4.21 Mastodon versions prior to 4.5.14 Mastodon versions prior to 4.6.4 Mastodon versions prior to 4.7.0-beta.1 Description Administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and...

Photon OS 5.0: Postgresql15 PHSA-2025-5.0-91-0683

An update of the postgresql15 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0683. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

PT-2026-69328

Name of the Vulnerable Software and Affected Versions SourceCodester Simple Doctors Appointment System version 1.0 Description A SQL injection flaw exists that allows remote attackers to manipulate the ID argument. This issue occurs within an unknown function in the '/admin/ajax.php?action=set...

Photon OS 5.0: Postgresql13 PHSA-2025-5.0-91-0490

An update of the postgresql13 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0490. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

WordPress Core 6.9-7.0.1 - Pre-Auth Batch-Route Confusion

WordPress core versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are vulnerable to a pre-authentication route confusion issue in the REST API batch endpoint /?restroute=/batch/v1. A malformed nested batch request desynchronizes the batch router, allowing unauthenticated requests to reach...

CVE-2026-19364

A vulnerability was determined in itsourcecode Hospital Management System 1.0. The affected element is an unknown function of the file /viewdoctorconsultancycharge.php. This manipulation of the argument delid causes sql injection. The attack is possible to be carried out remotely. The exploit has...