222838 matches found
CVE-2026-62238 OpenRemote < 1.26.0 SQL Injection via Crosstab Export
OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint that constructs PostgreSQL queries by concatenating asset display names into raw SQL. An authenticated attacker with asset creation or rename permissions can inject SQL through...
CVE-2026-62238
OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint that constructs PostgreSQL queries by concatenating asset display names into raw SQL. An authenticated attacker with asset creation or rename permissions can inject SQL through...
CVE-2026-52348
cool-admin-java 8.0.0 has a SQL injection vulnerability in the order method of CrudOption.java...
PT-2026-60810
Name of the Vulnerable Software and Affected Versions Sangoma Switchvox versions prior to 8.4.0.2 Description An unauthenticated SQL injection exists in the /pa endpoint, which processes XML content beginning with . The issue occurs because the PhoneIP value is concatenated directly into PostgreS...
WordPress Core wp2shell Unauthenticated SQL Injection via REST Batch Route Confusion
WordPress core 6.9.0 - 6.9.4 and 7.0.0 - 7.0.1 are affected by an unauthenticated SQL injection reachable through the REST API batch endpoint /batch/v1. The batch controller builds parallel $matches the matched handler per sub-request and $validation the validation result per sub-request arrays,...
CVE-2026-52348
CVE-2026-52348 affects cool-admin-java 8.0.0 with a SQL injection vulnerability in the order() method of CrudOption.java. Root cause per sources is improper handling of input in that method leading to injectable SQL. Affected product is specified; no vendor/version beyond 8.0.0 is indicated in th...
VulnCheck KEV: CVE-2026-60137
WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the authornotin parameter of WPQuery, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter...
WordPress WP2Shell REST API Batch Route Confusion SQLi to RCE
This module chains two WordPress core vulnerabilities, together known as WP2Shell, to gain unauthenticated remote code execution against default installs of WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1. The vulnerabilities are fixed in WordPress 6.9.5 and 7.0.2. CVE-2026-60137 is an SQL injection in...
PT-2026-60856
Name of the Vulnerable Software and Affected Versions WordPress versions 6.9.0 through 6.9.4 WordPress versions 7.0.0 through 7.0.1 Description A route confusion issue in the REST API batch endpoint, combined with a SQL injection in the WP Query class, allows a remote attacker to execute arbitrar...
VulnCheck KEV: CVE-2026-63030
WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the authornotin WPQuery SQL Injection CVE-2026-60137, could allow an attacker to perform SQL Injection and achieve Remote Code Execution...
SQL Injection
Overview com.bstek.ureport:ureport2-console is an UReport2 is a high-performance pure Java report engine based on Spring architecture, where complex Chinese-style statements and reports can be prepared by iterating over cells. Affected versions of this package are vulnerable to SQL Injection...
CVE-2026-14782
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to SQL Injection via the Customer Import in all versions up to, and including, 2.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...
CVE-2026-14782
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to SQL Injection via the Customer Import in all versions up to, and including, 2.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...
CVE-2026-14782
The CVE-2026-14782 entry concerns the Booking for Appointments and Events Calendar – Amelia plugin for WordPress. A SQL Injection exists via the Customer Import feature in all versions up to and including 2.4.3, due to insufficient escaping of the user-supplied parameter and inadequate preparatio...
CVE-2026-38158
A SQL injection vulnerability in the /ureport/datasource/previewData component of ureport v2.2.9 allows attackers to access sensitive database information via crafted SQL statements...
SQL Injection
Overview johnpbloch/wordpress-core is a web software you can use to create a website or blog. Affected versions of this package are vulnerable to SQL Injection in the WPQuery::getposts method of class-wp-query.php, which applies integer casting to the authornotin query variable only when it is an...
Remote Code Execution (RCE)
Overview johnpbloch/wordpress-core is a web software you can use to create a website or blog. Affected versions of this package are vulnerable to Remote Code Execution RCE due to a REST API batch-route confusion weakness in the batch request endpoint, which resolves batched subrequests in a way...
armature-diesel (0.1.0), aruna_policy (>=0.1.0, <=0.1.2) +112 more potentially affected by unknown CVE via diesel (>=2.0.0, <=2.3.4)
diesel CARGO version =2.0.0, =0.1.0, =0.1.0, =0.6.0, =0.1.0, =0.1.0, =0.0.6, =0.1.1, =0.1.5, =0.1.0, =0.1.2, =0.1.6 and more Source cves: unknown CVE Source advisory: OSV:GHSA-GGXF-9F6J-W742...
