PT-2026-113637

The Hyyan WooCommerce Polylang Integration plugin for WordPress is vulnerable to SQL Injection via the 'variation ids' parameter of the 'woocommerce remove variations' AJAX action in versions up to, and including, 1.5.0 due to insufficient escaping on the user supplied parameter and lack of...

PT-2026-113624

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via the 'inputs' parameter in all versions up to, and including, 1.15.48 due to insufficient escaping on the user supplied parameter and lack of sufficient...

PT-2026-113689

A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary SQL statements in the context of the application's database account...

PT-2026-113702

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Codepeople CP Multi View Event Calendar cp-multi-view-calendar allows SQL Injection.This issue affects CP Multi View Event Calendar : from n/a through 1.4.41...

PT-2026-113618

The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via 'product.push' Identity Endpoint in all versions up to, and including, 2.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...

PT-2026-113610

The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart persistent meta value in all versions up to, and including, 10.8.0 due to insufficient escaping on user supplied data and lack of sufficient preparation on the existing SQL query in the...

PT-2026-113654

The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it in a SQL statement, and verifies its payment webhook with a signing secret that is empty by default, allowing unauthenticated attackers to perform SQL...

PT-2026-113688

The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database...

PT-2026-113602

The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'validate' parameter in all versions up to, and including, 10.8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...

PT-2026-113714

Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/cat issues top.pl script sub calculate concatenates the user-controlled Criteria, Filter, and Limit request parameters directly into dynamic SQL. Criteria is only prefix-normalized and never validated against an...

PT-2026-113626

The Gmedia Photo Gallery plugin for WordPress is vulnerable to time-based SQL Injection via the 'gmedia in' parameter in all versions up to, and including, 1.25.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes i...

RHEL 8 : mariadb-connector-c (RHSA-2026:83080)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:83080 advisory. The MariaDB Native Client library C driver is used to connect applications developed in C/C++ to MariaDB and MySQL databases. Security Fixes: mariad...

CVE-2024-21513

CVE-2024-21513 PoC for CVE-2024-21513 Original exploit documented by Snyk Security Research Exploit CVE-2024-21513 is a vulnerability in langchain-experimental where unvalidated SQL query results were passed to Python's eval, enabling remote code execution through SQL-based input injection. PoC...

CVE-2024-13485

CVE-2024-13485 LTL Freight Quotes – ABF Freight Edition = 3.3.7 - Unauthenticated SQL Injection Description The LTL Freight Quotes – ABF Freight Edition plugin for WordPress is vulnerable to SQL Injection via the 'editid' and 'dropshipeditid' parameters in all versions up to, and including, 3.3.7...

CVE-2026-110083

Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized...

CVE-2026-63165 Omnispace Agora Project < 26.10.0 SQL Injection via sortEvents Parameter

Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject malicious SQL by manipulating the sortEvents parameter, which is concatenated into the ORDER BY clause without sanitization in...

CVE-2026-63165

The Omnispace Agora Project version prior to 26.10.0 is vulnerable to a SQL injection flaw within its calendar functionality. The root cause is the lack of sanitization for the sortEvents parameter, which is directly concatenated into an ORDER BY clause in the app/ModCalendar/CtrlCalendar.php fil...

CVE-2026-63152

The Omnispace Agora Project (versions prior to 26.10.0 ) is vulnerable to a second-order SQL injection in the _idCategoryFilter parameter. Authenticated attackers can inject a malicious payload that is persisted into the session. This payload is subsequently concatenated into a SQL statement with...

CVE-2026-63152 Omnispace Agora Project < 26.10.0 Second-Order SQL Injection via _idCategoryFilter

Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability that allows authenticated attackers to inject malicious SQL via the idCategoryFilter parameter, which is persisted into the session and later concatenated into a SQL statement without parameterization...

CVE-2026-110083

Adobe Experience Manager is impacted by an SQL Injection vulnerability (CWE-89 ) caused by the improper neutralization of special elements used in an SQL command. A low-privileged attacker could exploit this issue without user interaction to bypass security measures, potentially gaining unauthori...