284526 matches found
CVE-2026-89302: Improper Neutralization of Special Elements used in an SQL Command
The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...
CVE-2026-89299: Improper Neutralization of Special Elements used in an SQL Command
The WP Verify API WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...
CVE-2026-89297: Improper Neutralization of Special Elements used in an SQL Command
The Loja Automática WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...
CVE-2026-89287: Improper Neutralization of Special Elements used in an SQL Command
The ASPL Product Quotation WordPress plugin through 1.1.0 does not sanitize and escape a parameter before using it in SQL statements, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database...
CVE-2026-89285: Improper Neutralization of Special Elements used in an SQL Command
The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several request parameters before using them to build a SQL query, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database...
CVE-2026-89234: Improper Neutralization of Special Elements used in an SQL Command
The WP-Partner WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database...
CVE-2026-89214: Improper Neutralization of Special Elements used in an SQL Command
The WpCues Basic Quiz WordPress plugin through 1.6.5 does not properly sanitise and escape values before using them in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database...
CVE-2026-81420: Improper Neutralization of Special Elements used in an SQL Command
The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it in a SQL statement in one of its unauthenticated AJAX actions, allowing unauthenticated users to perform SQL injection attacks...
CVE-2026-103695: Improper Neutralization of Special Elements used in an SQL Command
The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks...
FreeBSD : py-WsgiDAV -- Multiple vulnerabilities (0f5aaca7-c4d5-11f1-96b4-74563cf85f9d)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 0f5aaca7-c4d5-11f1-96b4-74563cf85f9d advisory. [email protected] reports: WsgiDAV is a generic and extendable WebDAV server based on WSGI. WsgiDA...
CVE-2026-108773: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was detected in erzhongxmu JEEWMS up to 2026.09.27-W39. Impacted is the function docheck of the file src/main/java/com/zzjee/wm/controller/WmOmNoticeHController.java. Performing a manipulation of the argument goodscode results in sql injection. The attack may be initiated remotely...
CVE-2026-59508: Improper Neutralization of Special Elements used in an SQL Command
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Interuse i-Bos. This issue affects i-Bos: 3.0...
CVE-2026-108684: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was detected in erzhongxmu Jeewms up to 3.7. This affects the function getTreeData of the file src/main/java/com/jeecg/demo/controller/JeecgFormDemoController.java of the component Autocomplete Data Handler. Performing a manipulation of the argument searchVal results in sql...
CVE-2026-88930: Improper Neutralization of Special Elements used in an SQL Command
The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requests authorised by it, and does not sanitise and escape a parameter before using it in an SQL statement, allowing unauthenticated users to perform SQL injection attacks...
PT-2026-110352
A vulnerability has been found in erzhongxmu JEEWMS up to 2026.09.27-W39. The impacted element is the function WvNoticeController.list of the file com/zzjee/wmapi/controller/WvNoticeController.java of the component Search Endpoint. The manipulation of the argument searchstr leads to sql injection...
CVE-2026-62117
Subscriber SQL Injection in Barcode Scanner with Inventory & Order Manager = 1.13.1 versions...
CVE-2026-62031
Unauthenticated SQL Injection in uListing = 2.2.0 versions...
CVE-2026-42722
Administrator SQL Injection in Frontend Admin by DynamiApps = 3.29.13 versions...