284543 matches found
CVE-2026-42633: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in Events Manager = 7.4.6 versions...
CVE-2026-42722: Improper Neutralization of Special Elements used in an SQL Command
Administrator SQL Injection in Frontend Admin by DynamiApps = 3.29.13 versions...
PT-2026-109783
Name of the Vulnerable Software and Affected Versions Frontend Admin by DynamiApps versions prior to 3.29.14 Description An SQL Injection issue exists in the administrator section, allowing an attacker to interfere with the queries that an application makes to its database. Recommendations Update...
CVE-2026-104023: Improper Neutralization of Special Elements used in an SQL Command
The Smart Popup by Supsystic plugin for WordPress is vulnerable to generic SQL Injection via the 'sidx' parameter in all versions up to, and including, 1.13.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...
PT-2026-109777
Name of the Vulnerable Software and Affected Versions Qode Tours versions prior to 3.1.3.3 Description An issue exists that allows for SQL Injection, a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database...
CVE-2026-42712: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in Qode Tours = 3.1.3.2 versions...
CVE-2026-96653: Improper Neutralization of Special Elements used in an SQL Command
The WP Directory Kit plugin for WordPress is vulnerable to time-based SQL Injection via 'displayname' Profile Field Second-Order in all versions up to, and including, 1.5.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...
CVE-2026-108474
JetBrains Exposed versions prior to 1.5.1 are vulnerable to an SQL injection flaw. The vulnerability stems from unescaped string arguments passed to several SQL functions. This flaw allows an attacker to potentially compromise the integrity, confidentiality, and availability of the database. Reme...
CVE-2026-108474
In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions...
hackazon
Hackazon Hackazon es un sitio de prueba vulnerable gratuito que es una tienda en línea construida con las mismas tecnologías utilizadas en las aplicaciones móviles y de cliente enriquecido actuales. Hackazon tiene una interfaz AJAX, flujos de trabajo estrictos y API RESTful utilizadas por una...
pymap
pymap — SQL injection discovery & exploitation toolkit Two co...
WordPress Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin <= 5.7.2 - Unauthenticated SQL Injection vulnerability
Unauthenticated SQL Injection vulnerability discovered by zickzick2 in WordPress Plugin LatePoint versions = 5.7.2...
WordPress WP Directory Kit plugin <= 1.5.9 - Authenticated (Subscriber+) SQL Injection vulnerability
Authenticated Subscriber+ SQL Injection vulnerability discovered by Tarcísio Luchesi De Almeida Silva Poystick in WordPress Plugin WP Directory Kit versions = 1.5.9...
WordPress WP Booking System – Booking Calendar plugin <= 2.1.0.1 - Authenticated (Subscriber+) SQL Injection vulnerability
Authenticated Subscriber+ SQL Injection vulnerability discovered by Spy0x7 in WordPress Plugin WP Booking System versions = 2.1.0.1...
CVE-2026-108096 Improper authorization in query resolvers for SQL-backed models in AWS Amplify API Category
Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might allow an authenticated remote user to read records owned by other users of the same application via crafted queries. This issue has been addressed in...
CVE-2026-108096 Improper authorization in query resolvers for SQL-backed models in AWS Amplify API Category
Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might allow an authenticated remote user to read records owned by other users of the same application via crafted queries. This issue has been addressed in...
WordPress Smart Popup by Supsystic plugin <= 1.13.2 - Authenticated (Administrator+) SQL Injection vulnerability
Authenticated Administrator+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Popup by Supsystic versions = 1.13.2...
WordPress FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin <= 3.1.13 - Authenticated (Author+) SQL Injection vulnerability
Authenticated Author+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin FireBox versions = 3.1.13...
