CVE-2026-59538

Unauthenticated SQL Injection in GamiPress = 7.9.7 versions...

CVE-2026-65766

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder 6.7.1 - Improper validation of order parameters in the Dynamic Content endpoint leads to an SQL injection vector...

CVE-2026-59550

Unauthenticated SQL Injection in AWP Classifieds = 4.4.7 versions...

CVE-2026-59549

Affected software: WordPress plugin rtMedia for WordPress, BuddyPress and bbPress (versions <= 4.7.10). Vulnerability: Unauthenticated SQL Injection. Root cause/impact: SQL injection that does not require authentication; CVSS metrics in the external record indicate high confidentiality impact ...

CVE-2026-59549

Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress = 4.7.10 versions...

EUVD-2026-49218

Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress = 4.7.10 versions...

CVE-2026-59538

Unauthenticated SQL Injection in GamiPress = 7.9.7 versions...

CVE-2026-59527

The CVE-2026-59527 entry describes an unauthenticated SQL Injection in the WordPress MapSVG plugin, affected versions 8.14.0 and earlier. The issue originates from MapSVG’s handling of inputs in vulnerable components, allowing a remote attacker to manipulate queries and potentially access or modi...

CVE-2026-65876

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder 6.8.0 - Improper validation of catid parameters in the loadMoreArticles endpoint leads to an SQL injection vector...

CVE-2026-65876 Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.8.0

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder 6.8.0 - Improper validation of catid parameters in the loadMoreArticles endpoint leads to an SQL injection vector...

Appriss Insights VINE Application SQL Injection

RISK EVALUATION The Appriss Insights Equifax VINE applications allow an unauthenticated attacker to send a specially-crafted request to bypass the login page, access other users' credentials, take over other user accounts, access sensitive PII, and dump other information from the database. 2...

EUVD-2026-48314

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 - Improper validation of order parameters lead to an unauthenticated SQL injection in easystore, allowing full DB read access including credentials and sessions...

CVE-2026-59514

Unauthenticated SQL Injection in Buddyboss Platform = 3.0.5 versions...

EUVD-2026-48206

Unauthenticated SQL Injection in WPDM – Premium Packages = 6.2.0 versions...

CVE-2026-59525 WordPress Participants Database plugin <= 2.7.8.3 - SQL Injection vulnerability

Unauthenticated SQL Injection in Participants Database = 2.7.8.3 versions...

PT-2026-64032

Name of the Vulnerable Software and Affected Versions Easy Store versions 1.0.0 through 2.0.1 Description Improper validation of order parameters allows an unauthenticated SQL injection, which is a technique used to manipulate database queries. This issue enables full read access to the database,...

CVE-2016-20096

Linknat VOS3000 and VOS2009 through version 2.1.2.0 contain an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands by manipulating the name parameter in a POST request to the login endpoint. Attackers can inject malicious SQL through the logi...

📄 WordPress WPCargo Track and Trace 7.0.6 Unauthenticated SQL Injection

WordPress WPCargo Track and Trace plugin version 7.0.6 contains an unauthenticated SQL injection vulnerability. A remote attacker can inject arbitrary SQL into database queries handled by the affected component. This proof of concept exploit demonstrates the vulnerable request flow against the...

CVE-2026-11349 Modern Events Calendar (Lite & Pro) < 7.34.0 - Unauthenticated SQL Injection via mec_list_load_more

The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and escape a request parameter before using it in a SQL statement, through an AJAX action available to unauthenticated users, leading to an unauthenticated SQL...

PT-2026-61522

The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and escape a request parameter before using it in a SQL statement, through an AJAX action available to unauthenticated users, leading to an unauthenticated SQL...