CVE-2026-2232

The Product Table and List Builder for WooCommerce Lite plugin for WordPress is vulnerable to time-based SQL Injection via the 'search' parameter in all versions up to, and including, 4.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2026-2232 Product Table and List Builder for WooCommerce Lite <= 4.6.2 - Unauthenticated Time-Based SQL Injection via 'search' Parameter

The Product Table and List Builder for WooCommerce Lite plugin for WordPress is vulnerable to time-based SQL Injection via the 'search' parameter in all versions up to, and including, 4.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2026-2232

CVE-2026-2232 affects the WordPress plugin Product Table and List Builder for WooCommerce Lite . Vulnerable component: the search functionality (search.php) where the parameter 'search' is not properly escaped, leading to a time-based SQL injection in all versions up to 4.6.2. Root cause: insuffi...

CVE-2026-2232 Product Table and List Builder for WooCommerce Lite <= 4.6.2 - Unauthenticated Time-Based SQL Injection via 'search' Parameter

The Product Table and List Builder for WooCommerce Lite plugin for WordPress is vulnerable to time-based SQL Injection via the 'search' parameter in all versions up to, and including, 4.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2026-2736 Reflected Cross-Site Scripting (XSS) vulnerability in Alkacon's OpenCms

Reflected Cross-site Scripting XSS in Alkacon's OpenCms v18.0, which allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL containing the ‘q’ parameter in ‘/search/index.html’. This vulnerability can be exploited to steal sensitive user...

CVE-2026-2736

Alkacon OpenCms 18.0 is affected by CVE-2026-2736: a reflected XSS vulnerability exploitable by sending a user a malicious URL containing the q parameter in /search/index.html. The issue allows execution of JavaScript in the victim’s browser, enabling potential access to session cookies or action...

CVE-2026-2232: Improper Neutralization of Special Elements used in an SQL Command

The Product Table and List Builder for WooCommerce Lite plugin for WordPress is vulnerable to time-based SQL Injection via the 'search' parameter in all versions up to, and including, 4.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

PT-2026-20866

Name of the Vulnerable Software and Affected Versions Product Table and List Builder for WooCommerce Lite versions prior to 4.6.3 Description The Product Table and List Builder for WooCommerce Lite plugin for WordPress is susceptible to time-based SQL Injection. This is due to inadequate escaping...

CVE-2024-55270

phpgurukul Student Management System 1.0 is vulnerable to SQL Injection in studentms/admin/search.php via the searchdata parameter...

CVE-2019-25337

CVE-2019-25337 affects OwnCloud 8.1.8. The issue is a username enumeration flaw exposing user accounts by manipulating the share.php endpoint: sending crafted GET requests to /index.php/core/ajax/share.php with a wildcard search parameter can reveal user information. Root cause appears to be impr...

CVE-2025-71179: Improper Neutralization of Input During Web Page Generation

Creativeitem Academy LMS 7.0 contains reflected Cross-Site Scripting XSS vulnerabilities via the search parameter to the /academy/blogs endpoint, and the string parameter to the /academy/coursebundles/search/query endpoint. These vulnerabilities are distinct from the patch for CVE-2023-4119, whic...

📄 feedyour.email 2.4.1 SQL Injection

A SQL injection vulnerability exists in feedyour.email versions 2.4.1 and below. The vulnerability allows remote attackers to execute arbitrary SQL commands via the search functionality. feedyour.email - SQL Injection via Search Parameter Advisory ID: RO-26-003 CVE ID: CVE-2025-XXXX Pending...

The vulnerability of the OpenSky flight planning and operational management system, related to the lack of measures to protect the SQL query structure, allows attackers to execute arbitrary SQL queries.

The vulnerability of the OpenSky flight planning and operational management system lies in the lack of measures to protect the SQL query structure during the processing of the search parameter. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

EUVD-2021-34764

Easy Cart Shopping Cart 2021 contains a non-persistent cross-site scripting vulnerability in the search module's keyword parameter. Remote attackers can inject malicious script code through the search input to compromise user sessions and manipulate application content...

CVE-2021-47856 Easy Cart Shopping Cart 2021 Cross-Site Scripting via Search Parameter

Easy Cart Shopping Cart 2021 contains a non-persistent cross-site scripting vulnerability in the search module's keyword parameter. Remote attackers can inject malicious script code through the search input to compromise user sessions and manipulate application content...

CVE-2021-47856

CVE-2021-47856 affects Easy Cart Shopping Cart 2021, with a non-persistent cross-site scripting flaw in the search module’s keyword parameter. The underlying issue is XSS in the search input that can expose or manipulate user sessions and content. A PoC exploit is indicated in connected data, but...

CVE-2021-47856 Easy Cart Shopping Cart 2021 Cross-Site Scripting via Search Parameter

Easy Cart Shopping Cart 2021 contains a non-persistent cross-site scripting vulnerability in the search module's keyword parameter. Remote attackers can inject malicious script code through the search input to compromise user sessions and manipulate application content...

EUVD-2020-30942

e-Learning PHP Script 0.1.0 contains a SQL injection vulnerability in the search functionality that allows attackers to manipulate database queries through unvalidated user input. Attackers can inject malicious SQL code in the 'search' parameter to potentially extract, modify, or access sensitive...

CVE-2020-37035

e-Learning PHP Script 0.1.0 contains a SQL injection vulnerability in the search functionality that allows attackers to manipulate database queries through unvalidated user input. Attackers can inject malicious SQL code in the 'search' parameter to potentially extract, modify, or access sensitive...

CVE-2020-37035 e-learning Php Script 0.1.0 - 'search' SQL Injection

e-Learning PHP Script 0.1.0 contains a SQL injection vulnerability in the search functionality that allows attackers to manipulate database queries through unvalidated user input. Attackers can inject malicious SQL code in the 'search' parameter to potentially extract, modify, or access sensitive...