ReactPress has SQL injection via dynamic column names in TypeORM query builders

Summary ReactPress API list endpoints build TypeORM QueryBuilder conditions using unsanitized HTTP query parameter names as SQL column identifiers e.g. article.$key . TypeORM parameterizes values but not column names, allowing unauthenticated attackers to inject SQL through crafted query string...

CVE-2026-96826

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Shazzad Hossain Khan W4 Post List allows Blind SQL Injection. This issue affects W4 Post List: from n/a through 3.0.6...

CVE-2026-96826 WordPress W4 Post List plugin <= 3.0.6 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Shazzad Hossain Khan W4 Post List allows Blind SQL Injection. This issue affects W4 Post List: from n/a through 3.0.6...

CVE-2026-96826 WordPress W4 Post List plugin <= 3.0.6 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Shazzad Hossain Khan W4 Post List allows Blind SQL Injection. This issue affects W4 Post List: from n/a through 3.0.6...

EUVD-2026-85649

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Shazzad Hossain Khan W4 Post List allows Blind SQL Injection. This issue affects W4 Post List: from n/a through 3.0.6...

CVE-2026-96826

The W4 Post List WordPress plugin, developed by Shazzad Hossain Khan, is vulnerable to Blind SQL Injection in versions up to and including 3.0.6 . The root cause is the improper neutralization of special elements used in an SQL command. This vulnerability allows an attacker to executeblind SQL qu...

CVE-2026-96600

Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled identifiers and administrator-supplied values directly into SQL statements. Authenticated Contao backend users with Isotope module permissions can exploit...

EUVD-2026-85341

Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled identifiers and administrator-supplied values directly into SQL statements. Authenticated Contao backend users with Isotope module permissions can exploit...

CVE-2026-96600 Isotope eCommerce through 2.9.10 SQL Injection via Backend Callbacks

Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled identifiers and administrator-supplied values directly into SQL statements. Authenticated Contao backend users with Isotope module permissions can exploit...

CVE-2026-96600

Isotope eCommerce versions through 2.9.10 are vulnerable to a blind SQL injection within backend callbacks. The root cause is the direct interpolation of request-controlled identifiers and administrator-supplied values into SQL statements. This flaw allows authenticated Contao backend users with ...

CVE-2026-96272

ClipBucket v5 before 5.5.3-182 contains a blind SQL injection vulnerability in the photo search endpoint where the query parameter is passed unsanitized into SQL WHERE and ORDER BY clauses. Unauthenticated attackers can exploit time-based blind SQL injection techniques to extract user credentials...

CVE-2026-96272 ClipBucket v5 before 5.5.3-#182 SQL Injection via search_result.php

ClipBucket v5 before 5.5.3-182 contains a blind SQL injection vulnerability in the photo search endpoint where the query parameter is passed unsanitized into SQL WHERE and ORDER BY clauses. Unauthenticated attackers can exploit time-based blind SQL injection techniques to extract user credentials...

CVE-2026-96272 ClipBucket v5 before 5.5.3-#182 SQL Injection via search_result.php

ClipBucket v5 before 5.5.3-182 contains a blind SQL injection vulnerability in the photo search endpoint where the query parameter is passed unsanitized into SQL WHERE and ORDER BY clauses. Unauthenticated attackers can exploit time-based blind SQL injection techniques to extract user credentials...

CVE-2026-96272 ClipBucket v5 before 5.5.3-#182 SQL Injection via search_result.php

ClipBucket v5 before 5.5.3-182 contains a blind SQL injection vulnerability in the photo search endpoint where the query parameter is passed unsanitized into SQL WHERE and ORDER BY clauses. Unauthenticated attackers can exploit time-based blind SQL injection techniques to extract user credentials...

CVE-2026-96272

ClipBucket v5 versions prior to 5.5.3-#182 are vulnerable to a blind SQL injection vulnerability within the photo search endpoint. The root cause is the unsanitized passage of the query parameter into SQL WHERE and ORDER BY clauses. Unauthenticated attackers can leverage time-based blind SQL inje...

EUVD-2026-84991

ClipBucket v5 before 5.5.3-182 contains a blind SQL injection vulnerability in the photo search endpoint where the query parameter is passed unsanitized into SQL WHERE and ORDER BY clauses. Unauthenticated attackers can exploit time-based blind SQL injection techniques to extract user credentials...

PT-2026-97346

Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled identifiers and administrator-supplied values directly into SQL statements. Authenticated Contao backend users with Isotope module permissions can exploit...

CVE-2026-96272: Improper Neutralization of Special Elements used in an SQL Command

ClipBucket v5 before 5.5.3-182 contains a blind SQL injection vulnerability in the photo search endpoint where the query parameter is passed unsanitized into SQL WHERE and ORDER BY clauses. Unauthenticated attackers can exploit time-based blind SQL injection techniques to extract user credentials...

CVE-2026-96826: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Shazzad Hossain Khan W4 Post List allows Blind SQL Injection. This issue affects W4 Post List: from n/a through 3.0.6...

CVE-2026-96600: Improper Neutralization of Special Elements used in an SQL Command

Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled identifiers and administrator-supplied values directly into SQL statements. Authenticated Contao backend users with Isotope module permissions can exploit...