251306 matches found
CVE-2026-59538: Improper Neutralization of Special Elements used in an SQL Command
Unauthenticated SQL Injection in GamiPress = 7.9.7 versions...
WordPress SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin <= 3.9.7 - Authenticated (Administrator+) SQL Injection vulnerability
Authenticated Administrator+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin SMS Alert Order Notifications versions = 3.9.7...
CVE-2026-59537: Improper Neutralization of Special Elements used in an SQL Command
Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce = 2.10.22 versions...
CVE-2026-59551: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress = 4.7.10 versions...
CVE-2026-65877: Improper Neutralization of Special Elements used in an SQL Command
Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder 6.7.1 - Improper validation of various parameters in the media manager search and date filters lead to an SQL injection vector...
PT-2026-64912
Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder 6.7.1 - Improper validation of various parameters in the media manager search and date filters lead to an SQL injection vector...
CVE-2025-50455
A blind SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments versions
PT-2026-64932
Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce = 2.10.22 versions...
PT-2026-65057
WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author not in parameter of WP Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter...
CVE-2026-51077: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the sqlquery parameter of the syssqlquery.php component...
CVE-2025-50455
SQL injection vulnerability exists in the orderby parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments = 1.5.1. The vulnerability arises from unsanitized user input passed to the orderby method of the CodeIgniter Query Builder, enabling attackers to perform time-based...
CVE-2026-14189: Improper Neutralization of Special Elements used in an SQL Command
The WPBot WordPress plugin before 8.5.2 does not validate administrator-configured field identifiers before using them in a SQL query, allowing users with administrator access to perform SQL injection that executes when a visitor triggers a search...
PT-2026-64910
Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder 6.7.1 - Improper validation of order parameters in the Dynamic Content endpoint leads to an SQL injection vector...
CVE-2026-59550: Improper Neutralization of Special Elements used in an SQL Command
Unauthenticated SQL Injection in AWP Classifieds = 4.4.7 versions...
CVE-2026-59549: Improper Neutralization of Special Elements used in an SQL Command
Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress = 4.7.10 versions...
CVE-2025-50455: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability exists in the orderby parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments = 1.5.1. The vulnerability arises from unsanitized user input passed to the orderby method of the CodeIgniter Query Builder, enabling attackers to perform time-based...
CVE-2026-51077
SQL injection vulnerability in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the sqlquery parameter of the syssqlquery.php component...
Security Advisory 0145
Security Advisory 0145 . CSAF PDF Date: July 27, 2026 Revision | Date | Changes ---|---|--- 1.0 | July 27, 2026 | Initial release 1.1 | August 10, 2026 | Added CSAF JSON file for download Description: SQL injection in a flow metrics API method enabling server-side request forgery CVE: CVE-2026...