CVE-2026-49772

इवेंट्स कैलेंडर SQL इंजेक्शन CVE-2026-49772 PoC विवरण CVE-2026-49772 वर्डप्रेस प्लगइन द इवेंट्स कैलेंडर में एक अप्रमाणित ब्लाइंड SQL इंजेक्शन है। एक टूटा हुआ REST पैरामीटर वैलिडेटर validatecallback वैलिडेशन के बजाय एक क्लोज़र लौटाता है प्रयोगात्मक tec/v1 REST API पर order पैरामीटर को अनसेनेटाइज़्...

cve-2024-37765

विवरण MachForm संस्करण 19 तक एक प्रमाणित ब्लाइंड SQL इंजेक्शन से प्रभावित है जो उपयोगकर्ता खाता सेटिंग्स पृष्ठ में पाया जाता है। SQL इंजेक्शन हमलों में क्लाइंट एप्लिकेशन से इनपुट डेटा फ़ील्ड के उपयोग के माध्यम से SQL क्वेरी सम्मिलित करना शामिल है। इस प्रकार का हमला डेटाबेस तक पहुंच प्राप्त करने क...

CVE-2024-55270

نظام إدارة الطلاب 1.0 CVE-2024-55270 نظرة عامة نظام إدارة الطلاب SMS هو تطبيق ويب تم تطويره باستخدام PHP وMySQL لإدارة معلومات الطلاب. يحتوي هذا المستودع على الكود المصدري وتفاصيل النظام، بالإضافة إلى تقرير ثغرة أمنية. المدقق: شعيب علام - ملف لينكد إن تقرير الثغرة الأمنية الوصف تم اكتشاف ثغرة حقن...

cve-2026-3180

CVE-2026-3180 - WordPress Contest Gallery 28.1.4 - حقن SQL أعمى غير مصادق عليه الوصف تم اكتشاف ثغرة حقن SQL أعمى Blind SQL Injection في إضافة WordPress Contest Gallery الإصدارات 28.1.4 والإصدارات السابقة. تحدث المشكلة بسبب الاستخدام غير الآمن للمعامل cglmaili، حيث تحتفظ الدالة sanitizeemail بحرف...

CVE-2026-104460 YesWiki before 4.6.7 Unauthenticated Blind SQL Injection via newtextsearch

YesWiki before 4.6.7 contains a blind SQL injection vulnerability in the newtextsearch action because Bazar list option ids are concatenated into SQL REGEXP/LIKE clauses in actions/newtextsearch.php without escaping. Anonymous attackers can plant a malicious option id in an anonymously editable...

CVE-2026-104460

Versions of YesWiki prior to 4.6.7 are vulnerable to a blind SQL injection within the {{newtextsearch}} action. The root cause is the concatenation of Bazar list option ids into SQL REGEXP/LIKE clauses in actions/newtextsearch.php without proper escaping. This allows anonymous attackers to plant ...

CVE-2026-104460 YesWiki before 4.6.7 Unauthenticated Blind SQL Injection via newtextsearch

YesWiki before 4.6.7 contains a blind SQL injection vulnerability in the newtextsearch action because Bazar list option ids are concatenated into SQL REGEXP/LIKE clauses in actions/newtextsearch.php without escaping. Anonymous attackers can plant a malicious option id in an anonymously editable...

CVE-2026-104460 YesWiki before 4.6.7 Unauthenticated Blind SQL Injection via newtextsearch

YesWiki before 4.6.7 contains a blind SQL injection vulnerability in the newtextsearch action because Bazar list option ids are concatenated into SQL REGEXP/LIKE clauses in actions/newtextsearch.php without escaping. Anonymous attackers can plant a malicious option id in an anonymously editable...

CVE-2026-62059

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Ultimate Member Ultimate Member ultimate-member allows Blind SQL Injection.This issue affects Ultimate Member: from n/a through 2.13.1...

CVE-2026-62060

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in captivateaudio Captivate Sync captivatesync-trade allows Blind SQL Injection.This issue affects Captivate Sync: from n/a through 3.3.2...

CVE-2026-103338

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows Blind SQL Injection.This issue affects Unlimited Elements For Elementor...

CVE-2026-102379

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Blind SQL Injection.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC...

CVE-2026-62059 WordPress Ultimate Member plugin <= 2.13.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Ultimate Member Ultimate Member ultimate-member allows Blind SQL Injection.This issue affects Ultimate Member: from n/a through 2.13.1...

EUVD-2026-90809

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Ultimate Member Ultimate Member ultimate-member allows Blind SQL Injection.This issue affects Ultimate Member: from n/a through 2.13.1...

CVE-2026-62059 WordPress Ultimate Member plugin <= 2.13.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Ultimate Member Ultimate Member ultimate-member allows Blind SQL Injection.This issue affects Ultimate Member: from n/a through 2.13.1...

CVE-2026-62059

The Ultimate Member WordPress plugin (versions

CVE-2026-62060 WordPress Captivate Sync plugin <= 3.3.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in captivateaudio Captivate Sync captivatesync-trade allows Blind SQL Injection.This issue affects Captivate Sync: from n/a through 3.3.2...

CVE-2026-62060

The WordPress Captivate Sync plugin (versions

EUVD-2026-90808

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in captivateaudio Captivate Sync captivatesync-trade allows Blind SQL Injection.This issue affects Captivate Sync: from n/a through 3.3.2...

CVE-2026-62060 WordPress Captivate Sync plugin <= 3.3.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in captivateaudio Captivate Sync captivatesync-trade allows Blind SQL Injection.This issue affects Captivate Sync: from n/a through 3.3.2...