245918 matches found
CVE-2026-14554
The Check & Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privileges to perform SQL injection attacks...
EUVD-2026-51410
The Check & Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privileges to perform SQL injection attacks...
CVE-2026-14554
The Check & Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privileges to perform SQL injection attacks...
CVE-2026-63221 CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when used with where() conditions
CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch substitutes bound values from where conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the...
CVE-2026-63221
CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch substitutes bound values from where conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the...
CVE-2026-63221
CodeIgniter (PHP) 4.x contains a SQL injection in the Query Builder deleteBatch() path from 4.3.0–4.7.3. When used with where() conditions, deleteBatch() substitutes bound values into generated SQL and ignores escape flags, allowing user-controlled values to be interpreted as SQL. The issue does ...
CVE-2026-63221 CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when used with where() conditions
CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch substitutes bound values from where conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the...
CVE-2026-14538
An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component of Google mcp-toolbox versions 0.16.1 through 1.4.0 allows an authenticated attacker to bypass allowedDatasets validation checks. The toolbox relies on the BigQuery dry-run API to enfor...
SUSE CVE-2022-45786
There are issues with the AGE drivers for Golang and Python that enable SQL injections to occur. This impacts AGE for PostgreSQL 11 & AGE for PostgreSQL 12, all versions up-to-and-including 1.1.0, when using those drivers. The fix is to update to the latest Golang and Python drivers in addition t...
CVE-2025-69946
SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in ajaxData.php via the parameters districtid , divisionid, regionid, and wardid...
📄 WordPress 7.0.1 Remote Code Execution
A proof of concept exploit for WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 that contain an unauthenticated remote code execution vulnerability. The exploit chains a REST API batch route confusion vulnerability with a SQL injection vulnerability to write a PHP web shell to the w...
Debian dsa-6406 : libapache2-mod-php8.4 - security update
The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6406 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6406-1 [email protected] https://www.debian.org/securit...
CVE-2025-69948
SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin/deletegroup.php?id=1...
Adobe Campaign Classic SQL Injection Vulnerability
Adobe Campaign Classic is a marketing activity management platform developed by the American company Adobe. Adobe Campaign Classic has a SQL injection vulnerability, which stems from improper handling of special elements in SQL commands. Attackers can exploit this vulnerability to gain access to...
PT-2026-66697
The Check & Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privileges to perform SQL injection attacks...
PT-2026-66681
CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch substitutes bound values from where conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the...
CVE-2025-69946
SourceCodester Modern Loan Management System version 1.0 is vulnerable to SQL Injection in the ajaxData.php endpoint. The vulnerability is caused by improper handling of the district_id, division_id, region_id, and ward_id parameters, which allows for the insertion of malicious SQL statements for...
PT-2026-66716
The Product Feed Manager For WooCommerce WordPress plugin before 7.6.1 does not properly sanitise and escape product-feed custom filter rules before using them in a SQL query, allowing users with the Contributor role and above to perform SQL injection attacks...
SUSE SLED15 / SLES15 Security Update : perl-DBI (SUSE-SU-2026:3415-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3415-1 advisory. This update for perl-DBI fixes the following issues - CVE-2026-14380: unvalidated string eval interpolation of...
