CVE-2026-18592

A security flaw has been discovered in osCommerce 4.14.63493. Affected by this issue is the function EmailController of the file app/lib/backend/controllers/EmailController.php of the component Email Template Configuration. Performing a manipulation of the argument emailtemplateskey results in sq...

CVE-2026-18592 osCommerce Email Template Configuration EmailController.php EmailController sql injection

A security flaw has been discovered in osCommerce 4.14.63493. Affected by this issue is the function EmailController of the file app/lib/backend/controllers/EmailController.php of the component Email Template Configuration. Performing a manipulation of the argument emailtemplateskey results in sq...

CVE-2026-18592

CVE-2026-18592 affects osCommerce version 4.14.63493, specifically the function EmailController in app/lib/backend/controllers/EmailController.php of the Email Template Configuration component. The issue arises from manipulating the email_templates_key argument, which leads to a SQL injection vul...

CVE-2026-16572

The LogMyTrip WordPress plugin through 1.9 does not sanitize and escape a value taken from a cookie before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks on any page that renders one of the LogMyTrip WordPress plugin through 1.9's shortcodes...

CVE-2026-16532

The Link Library WordPress plugin before 7.9.3 does not properly sanitise and escape a user-supplied value before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-12965

The Super Store Finder WordPress plugin through 7.8 does not sanitize a parameter of an unauthenticated AJAX action before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection and extract data from the database...

CVE-2026-16539 SM Page Duplicator <= 1.0.0 - Editor+ SQL Injection via Page Duplication

The sm page duplicator WordPress plugin through 1.0.0 does not sanitise and escape a stored value before using it in a SQL statement when duplicating a page, allowing users with the Editor role and above to perform SQL Injection attacks...

EUVD-2026-52182

The sm page duplicator WordPress plugin through 1.0.0 does not sanitise and escape a stored value before using it in a SQL statement when duplicating a page, allowing users with the Editor role and above to perform SQL Injection attacks...

CVE-2026-16572 LogMyTrip <= 1.9 - Unauthenticated SQL Injection via 'tid' Cookie

The LogMyTrip WordPress plugin through 1.9 does not sanitize and escape a value taken from a cookie before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks on any page that renders one of the LogMyTrip WordPress plugin through 1.9's shortcodes...

EUVD-2026-52169

The Super Store Finder WordPress plugin through 7.8 does not sanitize a parameter of an unauthenticated AJAX action before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection and extract data from the database...

CVE-2026-16532 Link Library < 7.9.3 - Unauthenticated SQL Injection via the Front-End Link Submission Form

The Link Library WordPress plugin before 7.9.3 does not properly sanitise and escape a user-supplied value before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-16532

The CVE-2026-16532 affects the Link Library WordPress plugin prior to version 7.9.3. The defect stems from improper sanitisation/escaping of a user-supplied value used in a SQL query, enabling unauthenticated SQL injection via the front-end link submission form. Impact is unauthenticated access w...

CY376_-AHENKORA_JOSEPH-

CY376 Red Team Project — Exploiting Known CVEs in a Deliberate...

CVE-2026-51775

CVE-2026-51775 is a SQL injection vulnerability in Fastadmin v1.6.1.20250430. The flaw occurs in the application/common/controller/Backend.php component and reportedly allows an attacker to execute arbitrary code. The NVD entry lists a high impact with CVSS 3.1 base metrics: AV:N/AC:L/PR:N/UI:N/S...

PT-2026-69889

Name of the Vulnerable Software and Affected Versions Metabase affected versions not specified Description A remote, unauthenticated attacker can perform a SQL injection, which is the insertion of malicious SQL queries into input fields to manipulate a database, via the '/reset password' endpoint...

PT-2026-67508

Sequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if dialect is set to oracle. The escape function defined in sql-string.js does not escape quotes if the value starts with TO TIMESTAMP or TO DATE. In the Oracle dialect, when val is a string and starts...

CVE-2026-52521

A SQL injection vulnerability in Z-BlogPHP 1.7.5 allows authenticated attackers to execute arbitrary SQL commands via the id parameter in the CommentBat feature...

CVE-2026-51775

SQL injection vulnerability in Fastadmin v.1.6.1.20250430 allows an attacker to exectue arbitrary code via the application/common/controller/Backend.php component...

EUVD-2026-52480

SQL injection vulnerability in Fastadmin v.1.6.1.20250430 allows an attacker to exectue arbitrary code via the application/common/controller/Backend.php component...

PT-2026-67405

SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP...