CVE-2026-78143 code-projects Barangay Resident Profiling Management System Resident Search Functionality residents.php sql injection

A vulnerability was determined in code-projects Barangay Resident Profiling Management System 1.0. Affected is an unknown function of the file residents.php of the component Resident Search Functionality. This manipulation of the argument Search causes sql injection. Remote exploitation of the...

CVE-2026-78143 code-projects Barangay Resident Profiling Management System Resident Search Functionality residents.php sql injection

A vulnerability was determined in code-projects Barangay Resident Profiling Management System 1.0. Affected is an unknown function of the file residents.php of the component Resident Search Functionality. This manipulation of the argument Search causes sql injection. Remote exploitation of the...

PT-2026-79785

Name of the Vulnerable Software and Affected Versions code-projects Barangay Resident Profiling Management System version 1.0 Description An issue exists in the Resident Search Functionality within the residents.php file. Manipulation of the Search argument allows for remote SQL injection, a...

CVE-2026-16959

The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlers, allowing users with the Author role to perform SQL injection...

EUVD-2026-63820

The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlers, allowing users with the Author role to perform SQL injection...

PT-2026-79304

The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlers, allowing users with the Author role to perform SQL injection...

CVE-2026-16959: Improper Neutralization of Special Elements used in an SQL Command

The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlers, allowing users with the Author role to perform SQL injection...

Winter: Reflected XSS through the search query parameter in the backend Table widget

Impact Affected versions of Winter CMS render the search query parameter without HTML encoding inside a block in the backend Table widget partial modules/backend/widgets/table/partials/table.php: php value="" is an HTML raw-text context, so the surrounding value="…" attribute quoting is not a...

CVE-2026-76569

Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4...

EUVD-2026-63211

Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4...

CVE-2026-76569 Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4

Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4...

CVE-2026-76569 Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4

Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4...

PT-2026-78903

Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4...

EUVD-2026-57101

The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when a non-default search field type is configured...

CVE-2026-18473 WP Directory Kit < 1.5.5 - Unauthenticated SQL Injection via 'field_search' Parameter

The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

CVE-2026-71246

Pixelfed's SearchController behind the auth middleware accepts a URL via its remote-search parameters and fetches it server-side through ActivityPubFetchService, whose validateUrl only blocks the literal hosts 127.0.0.1, localhost, and ::1 and requires https, without checking the resolved IP...

CVE-2026-17505

The Translate Multilingual sites – TranslatePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to, and including, 3.2.5. This is due to the translatepage function unconditionally replacing the plugin's internal !trpst and !trpen marker...

CVE-2026-17505

The CVE covers TranslatePress

CVE-2026-5062

The PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin plugin for WordPress is vulnerable to SQL Injection via the 's' search parameter on the Pretty Links listing page in all versions up to, and including, 3.6.20. This is due to insufficient escapin...

EUVD-2026-53034

The PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin plugin for WordPress is vulnerable to SQL Injection via the 's' search parameter on the Pretty Links listing page in all versions up to, and including, 3.6.20. This is due to insufficient escapin...