PT-2026-108938

Name of the Vulnerable Software and Affected Versions PHPNuxBill versions prior to 2025.3.21 Description An unauthenticated SQL injection exists in the radius.php FreeRADIUS REST endpoint. The issue occurs because request parameters are interpolated into whereRaw queries. An attacker can send...

CVE-2019-9053-POC

CMS Made Simple ⚠️ Disclaimer: This script is for educational and authorized testing purposes only. Do not use it on systems you do not own or have explicit permission to test. The author and contributors are not responsible for any misuse or damage caused by this tool. 🎯 What is this? This is a...

CVE-2024-1207

Booking Calendar = 9.9 - Unauthenticated SQL Injection CVE-2024-1207 https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/booking/booking-calendar-99-unauthenticated-sql-injection POC: POST /wp-admin/admin-ajax.php HTTP/1.1 Host: vulnerablesite.com User-Agent: Mozilla/5.0...

CVE-2026-6806 Motors <= 1.4.109 - Unauthenticated Blind SQL Injection via 'stm_lat'/'stm_lng' Parameters

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'stmlat/stmlng' parameter in all versions up to, and including, 1.4.109 due to insufficient escaping on the user supplied parameter and lack of sufficient...

EUVD-2026-89428

The "supplierno" parameter used in the business allocation search feature is vulnerable to time-based blind SQL injection...

EUVD-2026-89438

The "search" parameter in the view audit logs feature within the utilities section is susceptible to a time-based blind SQL injection vulnerability...

EUVD-2026-89472

The "screenID" parameter in the electronic transaction queue viewer feature within the manual transactions section is susceptible to a time-based blind SQL injection vulnerability...

PT-2026-103059

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'stm lat/stm lng' parameter in all versions up to, and including, 1.4.109 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-72507

The "reportType" parameter in the product summary report feature within the balancing reports section is susceptible to a time-based blind SQL injection vulnerability...

CVE-2026-68954

The "pattern" parameter used in search function in the home page of the TMS application is vulnerable to time-based blind SQL injection vulnerability...

CVE-2026-68068

The "screenID" parameter in the electronic transaction queue viewer feature within the manual transactions section is susceptible to a time-based blind SQL injection vulnerability...

CVE-2026-72507 Toptech TMS7 and TopHAT SQL Injection

The "reportType" parameter in the product summary report feature within the balancing reports section is susceptible to a time-based blind SQL injection vulnerability...

CVE-2026-72507 Toptech TMS7 and TopHAT SQL Injection

The "reportType" parameter in the product summary report feature within the balancing reports section is susceptible to a time-based blind SQL injection vulnerability...

CVE-2026-68954 Toptech TMS7 and TopHAT SQL Injection

The "pattern" parameter used in search function in the home page of the TMS application is vulnerable to time-based blind SQL injection vulnerability...

CVE-2026-68954

The Toptech TMS7 and TopHAT applications are vulnerable to a time-based blind SQL injection vulnerability. The flaw exists in the "pattern" parameter utilized by the search function on the application's home page. This vulnerability allows an attacker to execute SQL commands and infer data based ...

CVE-2026-63713 Toptech TMS7 and TopHAT SQL Injection

The "search" parameter in the view audit logs feature within the utilities section is susceptible to a time-based blind SQL injection vulnerability...

CVE-2026-72510 Toptech TMS7 and TopHAT SQL Injection

The "supplierno" parameter used in the business allocation search feature is vulnerable to time-based blind SQL injection...

CVE-2026-72510 Toptech TMS7 and TopHAT SQL Injection

The "supplierno" parameter used in the business allocation search feature is vulnerable to time-based blind SQL injection...

CVE-2026-72510

The Toptech TMS7 and TopHAT systems are vulnerable to a time-based blind SQL injection flaw. The vulnerability exists within the **

CVE-2026-102570

ClipBucket v5 through 5.5.3-197 contains a time-based blind SQL injection vulnerability in the language update function where the languageid parameter is concatenated unescaped into the WHERE clause of an UPDATE statement. An authenticated administrator with basicsettings permission can inject...