CLEANSTART-2026-AE01714 Security fixes in crossplane-provider-sql-fips 0.13.0-r0

Package crossplane-provider-sql-fips version 0.13.0-r0 fixes 2 vulnerabilities: ghsa-j5w8-q4qc-rx2x, ghsa-f6x5-jh6r-wrfv...

CLEANSTART-2026-EV47067 Security fixes in crossplane-provider-sql 0.13.0-r0

Package crossplane-provider-sql version 0.13.0-r0 fixes 2 vulnerabilities: ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x...

SUSE-SU-2026:3415-1 Security update for perl-DBI

This update for perl-DBI fixes the following issues - CVE-2026-14380: unvalidated string eval interpolation of the Profile package name can lead to arbitrary Perl code execution bsc1271018. - CVE-2026-14740: one-byte out-of-bounds read when deleting an initial SQL comment line can lead to a proce...

Security update for perl-DBI

This update for perl-DBI fixes the following issues CVE-2026-14380: unvalidated string eval interpolation of the Profile package name can lead to arbitrary Perl code execution bsc1271018. CVE-2026-14740: one-byte out-of-bounds read when deleting an initial SQL comment line can lead to a process...

CVE-2026-58046

Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database, leading to full compromise of the panel...

CVE-2026-15153

The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query, allowing users holding the WP Hotel Booking WordPress plugin before 2.3.2's booking-management roles to perform SQL injection attacks...

Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

Summary IBM Enterprise Build of Quarkus is affected by vulnerabilities in Eclipse Vert.x, Eclipse Netty, LangChain4j and Apache Httpcore Vulnerability Details CVEID:CVE-2026-54399 DESCRIPTION: Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents...

CVE-2026-58046

Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database, leading to full compromise of the panel...

CVE-2026-58046

Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database, leading to full compromise of the panel...

EUVD-2026-51019

Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database, leading to full compromise of the panel...

CVE-2026-58046

CVE-2026-58046 affects Plesk, specifically the XML-RPC API. The root cause is improper neutralization, enabling a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database, with potential full panel compromise. No remediation details are pro...

CVE-2026-13395

The Online Scheduling and Appointment Booking System (also known as Bookly ) WordPress plugin, in versions before 27.8 , is vulnerable to an unauthenticated SQL injection . The root cause is the failure to sanitize or properly cast a user-supplied parameter—specifically the staff_id —from front-e...

CVE-2026-13395

The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks an...

EUVD-2026-50990

The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query, allowing users holding the WP Hotel Booking WordPress plugin before 2.3.2's booking-management roles to perform SQL injection attacks...

CVE-2026-15153 WP Hotel Booking < 2.3.2 - Hotel Manager+ SQL Injection via Booking List Search

The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query, allowing users holding the WP Hotel Booking WordPress plugin before 2.3.2's booking-management roles to perform SQL injection attacks...

CVE-2026-15153

The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query, allowing users holding the WP Hotel Booking WordPress plugin before 2.3.2's booking-management roles to perform SQL injection attacks...

wp2shell-poc-fulljs — Updated!

WordPress CVE Logical Flow Demonstration Overview This project allows to reproduce the logical flow related to CVE-2026-63030 and CVE-2026-60137 leading to an sql injection serving as a base to finally trigger a RCE in WordPress. CVE-2026-63030 CVE-2026-60137 The demonstration illustrates how the...

CVE-2026-48448

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to gain file system read access. Exploitation of this issu...

EUVD-2026-50951

The Improved Save Button plugin for WordPress is vulnerable to second-order SQL Injection via 'metakey' Custom Field via 'Save and Duplicate' Action in all versions up to, and including, 1.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2026-16092 Improved Save Button <= 1.2.1 - Authenticated (Author+) Second-Order SQL Injection via 'meta_key' Parameter

The Improved Save Button plugin for WordPress is vulnerable to second-order SQL Injection via 'metakey' Custom Field via 'Save and Duplicate' Action in all versions up to, and including, 1.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...