406 matches found
CVE-2026-54827
CVE-2026-54827 : Unauthenticated SQL Injection affecting WordPress Real Estate 7 theme versions ≤ 3.5.9. The vulnerability arises in the Real Estate 7 component and is exploitable without authentication, with a CVSS v3.1 base score of 9.3 (CRITICAL), indicating potential data exposure and confide...
EUVD-2026-39672
Unauthenticated SQL Injection in wpDataTables = 7.4 versions...
CVE-2026-54849
CVE-2026-54849 concerns WordPress Premmerce Wishlist for WooCommerce plugin versions <= 1.1.11, with unauthenticated SQL injection vulnerability. The connected records confirm the affected software (Premmerce Wishlist for WooCommerce), the vulnerable component (the plugin’s request handling le...
WordPress Dokan Pro plugin <= 5.0.4 - Unauthenticated SQL Injection vulnerability
Unauthenticated SQL Injection vulnerability discovered by lb in WordPress Plugin Dokan Pro versions = 5.0.4...
UBUNTU-CVE-2026-39893
Cacti is an open source performance and fault management framework. In versions 1.2.30 and prior, the rfilter request variable was concatenated into a RLIKE SQL clause without sanitization. The endpoint does not require authentication graph viewing supports guest access via the configured guest...
EUVD-2019-20191
Joomla Component vReview 1.9.11 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the cmId parameter. Attackers can send POST requests to the editReview task endpoint with URL-encoded SQL UNION...
EUVD-2017-18998
Joomla StreetGuessr Game 1.1.8 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the catid parameter. Attackers can send GET requests to index.php with the option=comstreetguess&view=maps parameters a...
PT-2026-50988
Name of the Vulnerable Software and Affected Versions Joomla! Component J-BusinessDirectory version 4.9.7 Description An SQL injection allows unauthenticated attackers to execute arbitrary SQL queries. This is achieved by injecting malicious code into the type parameter via GET requests to the...
EUVD-2026-37851
Nur-Alam39 bus-ticket no released versions; latest commit 459cabdbeb99c00225b26e46e3c2c30ae1de7bad contains an unauthenticated SQL injection vulnerability in businfo.php. The busid parameter received via HTTP POST is concatenated directly into a MySQL query select from businfo where id=$busid...
CVE-2026-48875
Unauthenticated SQL Injection in JetSmartFilters = 3.8.1 versions...
CVE-2026-40725
Unauthenticated PHP Object Injection in WooCommerce Product Filters 2.0.6 versions...
CVE-2026-22332
Unauthenticated SQL Injection in Tutor LMS Pro = 3.9.6 versions...
CVE-2026-40757
The CVE concerns WordPress Château theme version
CVE-2025-59554
The CVE-2025-59554 entry identifies an unauthenticated SQL injection in the WordPress plugin WordPress Advanced Ads – Tracking for versions before 3.0.7. Affected component: Tracking functionality within the Advanced Ads – Tracking plugin. Root cause: improper handling of input in the tracking fe...
Exploit for CVE-2026-9691
CVE-2026-9691 CVE-2026-9691: Integra...
CVE-2026-54811
CVE-2026-54811 : Affected software is the WordPress WP eMember plugin versions older than 10.9.4. The issue is an unauthenticated SQL Injection in the plugin, allowing an attacker with network access (no user credentials, no UI interaction) to potentially read or exfiltrate data. The CVSS metrics...
CVE-2026-54187 WordPress JetEngine plugin <= 3.8.10.1 - SQL Injection vulnerability
Unauthenticated SQL Injection in JetEngine = 3.8.10.1 versions...
CVE-2026-52706
CVE-2026-52706 : Unauthenticated PHP Object Injection in WordPress JetEngine plugin (versions ≤ 3.8.10). Affected component: JetEngine; vulnerability type: PHP Object Injection. Impact: high confidentiality, integrity, and availability (CVSS 3.1 base score 9.8; network attack vector; no user inte...
CVE-2026-49084
JetEngine (WordPress plugin) versions earlier than 3.8.9.1 are affected by unauthenticated SQL Injection. The vulnerability is described as a high-severity (CVSS 3.1: 9.3) issue with network access and no required privileges, impacting confidentiality. A fix is available in 3.8.9.1 and later; upg...