CVE-2026-17017

The CubeWP Framework WordPress plugin before 1.1.31 does not properly sanitize and escape a parameter before using it in a SQL statement through an AJAX action, and does not include a capability check on that action, allowing users with Subscriber-level access and above to perform SQL injection...

EUVD-2026-54884

The CubeWP Framework WordPress plugin before 1.1.31 does not properly sanitize and escape a parameter before using it in a SQL statement through an AJAX action, and does not include a capability check on that action, allowing users with Subscriber-level access and above to perform SQL injection...

CVE-2026-17017

The CubeWP Framework WordPress plugin, in versions prior to 1.1.31 , is vulnerable to SQL injection attacks. The root cause is the improper sanitization and escaping of a parameter used within a SQL statement during an AJAX action, coupled with a lack of sufficient capability checks. This flaw al...

CVE-2026-18473

The WP Directory Kit WordPress plugin, in versions prior to 1.5.5 , is vulnerable to SQL injection because it fails to properly sanitize and escape a parameter before using it in a SQL statement. This flaw is exploitable by unauthenticated users via the 'field_search' parameter. While the vulnera...

CVE-2026-18473

The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

CVE-2026-18473 WP Directory Kit < 1.5.5 - Unauthenticated SQL Injection via 'field_search' Parameter

The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

CVE-2026-18473 WP Directory Kit < 1.5.5 - Unauthenticated SQL Injection via 'field_search' Parameter

The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

CVE-2026-17044 WordPress File Upload < 5.1.8 - Unauthenticated SQL Injection via uniqueuploadid

The Iptanus File Upload WordPress plugin before 5.1.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by unauthenticated users...

CVE-2026-17044

The Iptanus File Upload WordPress plugin before 5.1.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by unauthenticated users...

CVE-2026-17044

The Iptanus File Upload WordPress plugin versions prior to 5.1.8 is vulnerable to an SQL injection because it fails to properly sanitize and escape the uniqueuploadid parameter before incorporating it into a SQL statement. This flaw allows unauthenticated users to execute malicious SQL code, pote...

CVE-2026-17044 WordPress File Upload < 5.1.8 - Unauthenticated SQL Injection via uniqueuploadid

The Iptanus File Upload WordPress plugin before 5.1.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by unauthenticated users...

CVE-2026-17044: Improper Neutralization of Special Elements used in an SQL Command

The Iptanus File Upload WordPress plugin before 5.1.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by unauthenticated users...

CVE-2026-19347: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in itsourcecode Hospital Management System 1.0. This issue affects some unknown processing of the file /viewdoctor.php. Such manipulation of the argument delid leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might b...

CVE-2026-19364: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in itsourcecode Hospital Management System 1.0. The affected element is an unknown function of the file /viewdoctorconsultancycharge.php. This manipulation of the argument delid causes sql injection. The attack is possible to be carried out remotely. The exploit has...

CVE-2026-19355: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in MingSoft MCMS up to 3.0.6. This affects the function ModelDataImpl.queryDiyFormData of the file /mdiy/form/data/list.do of the component ms-mdiy. Executing a manipulation of the argument formFields can lead to sql injection. The attack may be performed from remot...

CVE-2026-19344: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in code-projects Task Management System 1.0. Affected by this issue is some unknown functionality of the file /user/commentcountuser.php. The manipulation of the argument taskid leads to sql injection. It is possible to initiate the attack remotely. The exploit has...

CVE-2026-17017: Improper Neutralization of Special Elements used in an SQL Command

The CubeWP Framework WordPress plugin before 1.1.31 does not properly sanitize and escape a parameter before using it in a SQL statement through an AJAX action, and does not include a capability check on that action, allowing users with Subscriber-level access and above to perform SQL injection...

CVE-2026-18473: Improper Neutralization of Special Elements used in an SQL Command

The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

PT-2026-69292

Name of the Vulnerable Software and Affected Versions dresende node-sql-query versions 0.1.25 through 0.1.28 Description A SQL injection issue exists in the Request Parameter Handler component within the lib/Select.js library. The flaw is located in the SelectQuery.from and SelectQuery.build...

CVE-2026-19351: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in dresende node-sql-query 0.1.25/0.1.26/0.1.27/0.1.28. Affected by this vulnerability is the function SelectQuery.from/SelectQuery.build in the library lib/Select.js of the component Request Parameter Handler. Performing a manipulation results in sql injection. It is...