CVE-2026-17044 WordPress File Upload < 5.1.8 - Unauthenticated SQL Injection via uniqueuploadid

The Iptanus File Upload WordPress plugin before 5.1.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by unauthenticated users...

CVE-2026-17044 WordPress File Upload < 5.1.8 - Unauthenticated SQL Injection via uniqueuploadid

The Iptanus File Upload WordPress plugin before 5.1.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by unauthenticated users...

CVE-2026-19355: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in MingSoft MCMS up to 3.0.6. This affects the function ModelDataImpl.queryDiyFormData of the file /mdiy/form/data/list.do of the component ms-mdiy. Executing a manipulation of the argument formFields can lead to sql injection. The attack may be performed from remot...

CVE-2026-17044: Improper Neutralization of Special Elements used in an SQL Command

The Iptanus File Upload WordPress plugin before 5.1.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by unauthenticated users...

CVE-2026-19347: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in itsourcecode Hospital Management System 1.0. This issue affects some unknown processing of the file /viewdoctor.php. Such manipulation of the argument delid leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might b...

CVE-2026-19364: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in itsourcecode Hospital Management System 1.0. The affected element is an unknown function of the file /viewdoctorconsultancycharge.php. This manipulation of the argument delid causes sql injection. The attack is possible to be carried out remotely. The exploit has...

CVE-2026-19351: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in dresende node-sql-query 0.1.25/0.1.26/0.1.27/0.1.28. Affected by this vulnerability is the function SelectQuery.from/SelectQuery.build in the library lib/Select.js of the component Request Parameter Handler. Performing a manipulation results in sql injection. It is...

PT-2026-69292

Name of the Vulnerable Software and Affected Versions dresende node-sql-query versions 0.1.25 through 0.1.28 Description A SQL injection issue exists in the Request Parameter Handler component within the lib/Select.js library. The flaw is located in the SelectQuery.from and SelectQuery.build...

CVE-2026-17017: Improper Neutralization of Special Elements used in an SQL Command

The CubeWP Framework WordPress plugin before 1.1.31 does not properly sanitize and escape a parameter before using it in a SQL statement through an AJAX action, and does not include a capability check on that action, allowing users with Subscriber-level access and above to perform SQL injection...

CVE-2026-19344: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in code-projects Task Management System 1.0. Affected by this issue is some unknown functionality of the file /user/commentcountuser.php. The manipulation of the argument taskid leads to sql injection. It is possible to initiate the attack remotely. The exploit has...

CVE-2026-18473: Improper Neutralization of Special Elements used in an SQL Command

The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

PT-2026-69289

Name of the Vulnerable Software and Affected Versions itsourcecode Hospital Management System version 1.0 Description A remote SQL injection exists due to improper processing of the /viewdoctor.php endpoint. An attacker can exploit this by manipulating the delid variable to execute unauthorized...

CVE-2026-19343: Improper Neutralization of Special Elements used in an SQL Command

A flaw has been found in code-projects Task Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/AdminLogin.php. Executing a manipulation of the argument email/password can lead to sql injection. The attack may be performed from remote. The exploit...

PT-2026-69270

Name of the Vulnerable Software and Affected Versions Iptanus File Upload versions prior to 5.1.8 Description An issue exists where the software fails to properly sanitize and escape the uniqueuploadid parameter before incorporating it into a SQL statement. This allows unauthenticated users to...

CVE-2026-19354: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in lock-upme OPMS up to 831440f37a92c1568f2e071d5233bc873a9d8b09. The impacted element is an unknown function of the file controllers/messages/message.go of the component IN Clause Handler. Performing a manipulation of the argument ids results in sql injection. The attac...

Exploit for SQL Injection in Wordpress

|...

CVE-2026-16589

The WP Directory Kit WordPress plugin before 1.5.5 does not sanitize and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks authorization and nonce checks, allowing any authenticated user such as a Subscriber to perform SQL injection...

Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication

Metabase has warned that a maximum-severity security flaw impacting its business intelligence and data visualization software package has been exploited in the wild as a zero-day. The vulnerability CVSS score: 10.0, which does not carry a CVE identifier, allows an unauthenticated remote attacker ...

CVE-2026-16589

The WP Directory Kit WordPress plugin, in versions prior to 1.5.5 , is vulnerable to SQL injection . The root cause is the failure to sanitize and escape the data_fields_list parameter before its use in a SQL statement during an authenticated AJAX action. This action further lacks necessary autho...

CVE-2026-16589 WP Directory Kit < 1.5.5 - Subscriber+ SQL Injection via data_fields_list Parameter

The WP Directory Kit WordPress plugin before 1.5.5 does not sanitize and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks authorization and nonce checks, allowing any authenticated user such as a Subscriber to perform SQL injection...