⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0-Day and More

A single request should not be able to do this much. But this week, small inputs led to code execution, memory loss, stolen keys, and disabled security tools. The paths were often simple: exposed systems, weak checks, old drivers, fake prompts, and public code used for malware delivery. Some bugs...

CVE-2026-16244

A security vulnerability has been detected in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /prescriptionorderreport.php. Such manipulation of the argument delid leads to sql injection. The attack may be launched remotely. The...

CVE-2026-57309

CVE-2026-57309 involves a Blind SQL injection in Windu CMS. The vulnerability allows a remote, unauthenticated attacker to inject SQL syntax into the URL path in the HTTP header, leading to Blind SQL Injection. It has been confirmed in version 4.1 and may affect other versions. The report cites a...

EUVD-2026-45943

A Blind SQL injection vulnerability has been identified in Windu CMS. A remote unauthenticated attacker is able to inject SQL syntax into URL path in HTTP header resulting in Blind SQL Injection. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in versi...

CVE-2026-57309

A Blind SQL injection vulnerability has been identified in Windu CMS. A remote unauthenticated attacker is able to inject SQL syntax into URL path in HTTP header resulting in Blind SQL Injection. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in versi...

EUVD-2026-45940

A security vulnerability has been detected in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /prescriptionorderreport.php. Such manipulation of the argument delid leads to sql injection. The attack may be launched remotely. The...

CVE-2026-16244

The CVE-2026-16244 entry concerns itsourcecode Hospital Management System 1.0. The vulnerability affects the file /prescriptionorderreport.php where manipulation of the delid argument enables SQL injection. The issue is exploitable remotely, and the exploit has been publicly disclosed. Connected ...

Exploit for CVE-2026-63030

CVE-2026-63030: WordPress REST API Batch Route Confusion to SQ...

Exploit for CVE-2026-63030

CVE-2026-63030: WordPress REST API Batch Route Confusion to SQ...

Exploit for CVE-2026-60137

/ / / / / / | |/ / \ / /...

Exploit for SQL Injection in Sangoma Freepbx

CVE-2025-57819 — FreePBX SQL Injection → RCE PoC CVE-2025-5...

CVE-2026-11349 Modern Events Calendar (Lite & Pro) < 7.34.0 - Unauthenticated SQL Injection via mec_list_load_more

The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and escape a request parameter before using it in a SQL statement, through an AJAX action available to unauthenticated users, leading to an unauthenticated SQL...

Exploit for CVE-2026-63030

CVE-2026-63030 - WordPress REST API Batch Route Confusion PoC...

Linux Distros Unpatched Vulnerability : CVE-2026-39879

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Due to a missing sanitization call in afsqlddrunquery, syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the...

Exploit for CVE-2026-63030

wp2shell: WordPress Batch RCE A technical breakdown of CVE-20...

Exploit for CVE-2026-63030

wp2shell — CVE-2026-63030 + CVE-2026-60137 One-day WordPres...

Exploit for CVE-2026-63030

CVE-2026-63030 — WordPress wp2shell Exploit Unauthenticated d...

CVE-2026-16228

A vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /editschoolyr.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and...

CVE-2026-16227

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. This impacts an unknown function of the file /editsubject.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed...

CVE-2026-16227

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. This impacts an unknown function of the file /editsubject.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed...