CVE-2026-89214

The WpCues Basic Quiz WordPress plugin through 1.6.5 does not properly sanitise and escape values before using them in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database...

CVE-2026-42324

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/elementsetranks.php stores administrator-controlled imageorder values without enforcing the existing sort-field whitelist. The stored album imageorder expression is later concatenated into ORDER BY...

CVE-2026-42323 Piwigo: SQL Injection in Batch Manager

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/batchmanager.php accepts administrator-controlled dimension width, height, and ratio values and filesize values from the Batch Manager filter URL without numeric validation. The URL filter parser...

CVE-2026-42323: Improper Neutralization of Special Elements used in an SQL Command

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/batchmanager.php accepts administrator-controlled dimension width, height, and ratio values and filesize values from the Batch Manager filter URL without numeric validation. The URL filter parser...

CVE-2026-85188: Exposure of Sensitive Information to an Unauthorized Actor

Joomla Extension - regularlabs.com - Database data disclosure in Advanced Module Manager Free, Pro 12.1.0, Conditional Content Free, Pro 8.0.0, Content Templater Pro 14.2.0, ReReplacer Pro 16.2.0 for Joomla - The Conditions editor creates a default Condition Set name from the item to which the se...

GHSA-CH7P-MPV4-4VG4 CoreShop Vulnerable to SQL Injection via Admin Reports

Affected Versions - CoreShop 4.1.2 Demo tested Demo | CoreShop - Earlier versions may also be affected if the same code path exists Summary A blind SQL injection vulnerability exists in the application that allows an authenticated administrator-level user to extract database contents using...

CVE-2025-34242

Advantech WebAccess/VPN before version 1.1.5 contains a SQL injection in AjaxNetworkController.ajaxAction(). An authenticated, low-privileged observer can inject SQL via datatable search parameters, leading to disclosure of database information. Affected product/version: Advantech WebAccess/VPN

PT-2022-10463

Name of the Vulnerable Software and Affected Versions Nokia Broadcast Message Center versions prior to 11.1.0 Description The issue allows an authenticated user to perform a Boolean Blind SQL Injection attack on the endpoint "/owui/block/send-receive-updates" for the Manage Alerts page via the...

PT-2022-11959

Name of the Vulnerable Software and Affected Versions Quicklert for Digium version 10.0.0 1043 Description The issue affects the login.jsp page, allowing for Blind SQL Injection with Out-of-Band Interaction DNS and Blind Time-Based SQL Injections. This can be exploited to disclose all data within...

SQL Injection Vulnerability in YouDianCMS v8.0 Frontend

Youdiancms Enterprise Website Management System is an enterprise website building system developed by Changsha Youdian Software Technology Co. YouDianCMS v8.0 has a SQL injection vulnerability in the frontend, which can be exploited by attackers to obtain sensitive information from the database...

PT-2018-15246

Name of the Vulnerable Software and Affected Versions ERPNext versions 10.x through 11.0.3-beta.29 Description A SQL injection issue was discovered that allows an attacker to construct SQL queries to return any columns from any tables in the database. This issue is related to the...

CVE-2017-0914: Improper Neutralization of Special Elements used in an SQL Command

Gitlab Community and Enterprise Editions version 10.1, 10.2, and 10.2.4 are vulnerable to a SQL injection in the MilestoneFinder component resulting in disclosure of all data in a GitLab instance's database...