447 matches found
CVE-2026-49360
Recce (a data-validation toolkit for dbt PR review) versions prior to 1.50.0 are vulnerable to unauthenticated SQL execution through the query run API when deployed with a DuckDB-backed project and exposed to an untrusted network without authentication. An attacker can leverage DuckDB filesystem ...
EUVD-2026-64204
Recce is a data-validation toolkit for enhanced dbt data build tool PR review. Prior to version 1.50.0, OSS server deployments that expose the server to an untrusted network without authentication are vulnerable to unauthenticated SQL execution through the query run API. When Recce is configured...
CVE-2026-19053
The ProSolution WP Client WordPress plugin (versions before 2.0.6 ) is vulnerable to an unauthenticated blind SQL injection . The root cause is the failure to properly sanitise and escape the 'jobID' parameter before incorporating it into a SQL statement. This flaw is reachable by unauthenticated...
CVE-2026-16949
The Term Pages WordPress plugin versions prior to 2.0.0 is vulnerable to an unauthenticated SQL injection due to the tp_lookup vulnerability. The flaw exists because the plugin fails to properly sanitize and escape a parameter before incorporating it into a SQL statement. This allows an external ...
CVE-2026-3430
The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated SQL injection when the abandoned cart email is managed by creative mail...
EUVD-2026-54088
The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated SQL injection when the abandoned cart email is managed by creative mail...
CVE-2026-3430 Creative Mail 1.6.5 - 1.6.9 - Unauthenticated SQLi
The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated SQL injection when the abandoned cart email is managed by creative mail...
CVE-2026-66447 WordPress WordPress File Upload plugin <= 5.1.7 - SQL Injection vulnerability
Unauthenticated SQL Injection in WordPress File Upload = 5.1.7 versions...
CVE-2026-65546
Unauthenticated SQL Injection in Qode Tours = 3.1.3.1 versions...
Exploit for CVE-2026-9848
CVE-2026-9848 CVE-2026-9848 is an Unauthenticated SQL Injectio...
WordPress Online Scheduling and Appointment Booking System plugin < 27.8 - Unauthenticated SQL Injection vulnerability
Unauthenticated SQL Injection vulnerability discovered by Jakub Herman in WordPress Plugin Bookly versions 27.8...
WordPress mwp-viral-signup plugin <= 2.1 - Unauthenticated SQL Injection vulnerability
Unauthenticated SQL Injection vulnerability discovered by TAD Group in WordPress Plugin Wow Viral Signups versions = 2.1...
CVE-2026-16532 Link Library < 7.9.3 - Unauthenticated SQL Injection via the Front-End Link Submission Form
The Link Library WordPress plugin before 7.9.3 does not properly sanitise and escape a user-supplied value before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...
Exploit for CVE-2025-48932
CVE-2025-48932-Invision-Community-SQLi-Exploit CVE-2025-48932...
CVE-2026-14920 AcyMailing < 10.11.1 - Unauthenticated SQL Injection via subscription[] Parameter
Summary...
CVE-2025-67649 Unauthenticated SQL Injection in PHP Jabbers - Car Rental Script script
A SQL injection vulnerability has been identified in PHP Jabbers - Car Rental Script . Improper neutralization of input provided by user into parameters responsible for sorting functions allows an unauthenticated attacker to perform SQL Injection attacks. This issue was fixed in version 4.1...
WordPress Premium Packages – Sell Digital Products Securely plugin <= 6.2.0 - Unauthenticated SQL Injection vulnerability
Unauthenticated SQL Injection vulnerability discovered by Talal Nasraddeen in WordPress Plugin WPDM – Premium Packages versions = 6.2.0...
WordPress Project Management, Bug and Issue Tracking Plugin plugin < 5.1.0 - Unauthenticated SQL Injection vulnerability
Unauthenticated SQL Injection vulnerability discovered by Mokksh Parekh in WordPress Plugin Software Issue Manager versions 5.1.0...
CVE-2026-12741 WP Fast Total Search <= 1.80.280 - Unauthenticated SQL Injection
The WP Fast Total Search – The Power of Indexed Search plugin for WordPress is vulnerable to generic SQL Injection via the 'formdatas' parameter in all versions up to, and including, 1.80.280 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...