CVE-2026-61653 SuiteCRM: SQL injection via id param in modules/Campaigns/PopupCampaignRoi.php

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, modules/Campaigns/PopupCampaignRoi.php interpolates $REQUEST'id' into SQL. Although securexss normally entity-encodes quotes, an input prefixed with an XSS payload...

EUVD-2026-89468

The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request...

CVE-2026-71379 Toptech TMS7 and TopHAT Files or Directories Accessible to External Parties

The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request...

CVE-2026-62361

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET...

CVE-2026-4119

The Create DB Tables plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 1.2.1. The plugin registers adminpost action hooks for creating tables adminpostaddtable and deleting tables adminpostdeletedbtable without implementing any capability checks via...

PT-2026-34287

Name of the Vulnerable Software and Affected Versions Create DB Tables versions prior to 1.2.2 Description The Create DB Tables plugin for WordPress contains an authorization bypass. The plugin registers admin post action hooks for creating tables 'admin post add table' and deleting tables 'admin...

PT-2026-34290

Name of the Vulnerable Software and Affected Versions Table Manager versions prior to 1.0.1 Description The Table Manager plugin for WordPress allows authenticated attackers with Contributor-level access and above to extract sensitive data from arbitrary WordPress database tables. The issue occur...

CVE-2025-42929

Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tables, if the tables are not protected by an authorization group. This leads to a high impact on integrity and availability of the database...

CVE-2025-42929 Missing input validation vulnerability in SAP Landscape Transformation Replication Server

Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tables, if the tables are not protected by an authorization group. This leads to a high impact on integrity and availability of the database...