CVE-2026-89232: Improper Neutralization of Special Elements used in an SQL Command

The Recordbrowser WordPress plugin through 1.1.7 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database...

CVE-2026-108569: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in Furion .NET Framework up to 4.9.9.92. The impacted element is the function String.Replace of the file framework/Furion/Templates/Extensions/StringRenderExtensions.cs. The manipulation of the argument Name leads to sql injection. Remote exploitation of the attack ...

PT-2026-110187

Name of the Vulnerable Software and Affected Versions erzhongxmu Jeewms versions prior to 3.7 Description A remote SQL injection issue exists within the Autocomplete Data Handler component. The flaw is located in the getTreeData function of the...

PT-2026-110010

Name of the Vulnerable Software and Affected Versions Mobile builder WordPress plugin versions prior to 1.4.3 Description Unauthenticated users can perform SQL injection attacks because the plugin fails to sanitize and escape a parameter before incorporating it into a SQL statement. SQL injection...

PT-2026-110059

Name of the Vulnerable Software and Affected Versions Datalist it versions prior to 0.0.4 Description The Datalist it WordPress plugin fails to sanitize and escape several request parameters used in the construction of SQL queries. This allows unauthenticated attackers to execute SQL injection...

PT-2026-110063

Name of the Vulnerable Software and Affected Versions Post Voting System versions prior to 1.1 Description An issue exists where the software fails to properly sanitize and escape the id parameter before incorporating it into a SQL query. This allows unauthenticated users to execute SQL injection...

PT-2026-110065

Name of the Vulnerable Software and Affected Versions paymendo WordPress plugin versions prior to 1.2 Description The plugin fails to properly sanitize and escape the orderBy parameter before incorporating it into a SQL query. This flaw allows authenticated users to execute SQL injection attacks,...

PT-2026-110056

Name of the Vulnerable Software and Affected Versions Recordbrowser WordPress plugin versions prior to 1.1.8 Description An issue exists where the software fails to sanitize and escape the recordid parameter before incorporating it into a SQL query. This allows unauthenticated attackers to perfor...

PT-2026-110055

Name of the Vulnerable Software and Affected Versions WpCues Basic Quiz versions prior to 1.6.6 Description The plugin fails to properly sanitize and escape values before incorporating them into a SQL statement. This allows unauthenticated attackers to execute SQL injection attacks, which is a...

PT-2026-110053

Name of the Vulnerable Software and Affected Versions Site Setup Wizard versions prior to 1.5.9 Description An issue exists where the plugin fails to properly sanitize and escape a parameter before incorporating it into a SQL statement. This allows unauthenticated attackers to execute SQL injecti...

PT-2026-110025

Name of the Vulnerable Software and Affected Versions Tcard WP versions prior to 1.8.1 Description The plugin fails to sanitize and escape a parameter used in a SQL statement within an unauthenticated AJAX action. This allows unauthenticated users to execute SQL injection attacks, which involve...

PT-2026-110103

Name of the Vulnerable Software and Affected Versions Xinhu Rainrock RockOA versions prior to 2.7.7 Description A remote SQL injection exists within the Openkqj Action component. The issue occurs in the kqjcmdModel::returnchuli function located in the webmain/task/openapi/openkqjAction.php file. ...

PT-2026-110060

Name of the Vulnerable Software and Affected Versions ASPL Product Quotation versions prior to 1.1.1 Description An issue exists where the software fails to sanitize and escape the quote id parameter before incorporating it into SQL statements. This allows unauthenticated attackers to execute SQL...

PT-2026-110057

Name of the Vulnerable Software and Affected Versions WP-Partner versions prior to 1.2.2 Description An issue exists where the software fails to sanitize and escape the id parameter before incorporating it into a SQL query. This allows unauthenticated attackers to perform SQL injection, enabling...

PT-2026-110353

Name of the Vulnerable Software and Affected Versions erzhongxmu JEEWMS versions prior to 2026.09.27-W39 Description A remote SQL injection exists due to improper handling of the searchstr argument within the WvGiController.list function. SQL injection is a technique where an attacker inserts...

PT-2026-110351

A flaw has been found in erzhongxmu JEEWMS up to 2026.09.27-W39. The affected element is the function getbinall/getbinallagv of the file src/main/java/com/zzjee/md/controller/MdBinController.java. Executing a manipulation of the argument binstore/binid/des/cengshu can lead to sql injection. The...

PT-2026-110354

Name of the Vulnerable Software and Affected Versions erzhongxmu JEEWMS versions prior to 2026.09.27-W39 Description A remote SQL injection issue exists within the Inbound Quality Check Pda Interface component. The flaw is located in the WmInQmIController.list function within the...

PT-2026-110350

Name of the Vulnerable Software and Affected Versions erzhongxmu JEEWMS versions prior to 2026.09.27-W39 Description A remote SQL injection is possible through the manipulation of the goodscode argument within the docheck function of the...

PT-2026-110062

Name of the Vulnerable Software and Affected Versions WP Verify API versions prior to 1.0.1 Description Unauthenticated users can perform SQL injection attacks because the plugin fails to properly sanitize and escape the verify parameter before incorporating it into a SQL query. SQL injection is ...

PT-2026-110061

Name of the Vulnerable Software and Affected Versions Loja Automática versions prior to 1.0.1 Description Unauthenticated users can perform SQL injection attacks because the plugin fails to properly sanitize and escape the id parameter before incorporating it into a SQL query. SQL injection is a...