2377 matches found
Premium Packages – Sell Digital Products Securely - SQL Injection
Premium Packages – Sell Digital Products Securely WordPress plugin = 6.2.0 contains a SQL injection caused by insufficient escaping of 'code' parameter in CouponCodes::find method, letting unauthenticated attackers extract sensitive database information via crafted SQL queries. id: CVE-2026-12800...
Product Filter by WBW <= 3.4.6 - SQL Injection
WPFactory Product Filter by WBW woo-product-filter = 3.4.6 contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input. id: CVE-2026-112866 info: name: Product Filter by WBW...
CVE-2026-33944 Dolibarr: SQL Injection in societe/class/societe.class.php via localtax1_value parameter
Dolibarr is an open-source enterprise resource planning and customer relationship management application. Prior to 22.0.5 and 23.0.1, there is a SQL injection vulnerability in the Third Party company update functionality. The application concatenates the localtax1value and localtax2value ...
CVE-2026-69141
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the CasesController actiongetkbarticles action interpolates $POST'search' into a CASE WHEN ... LIKE expression and the SQL WHERE clause. Although securexss normally...
CVE-2026-69135
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the Project module interpolates the authenticated caller's duplicateId POST parameter directly into a SQL query without sanitization, quoting, or parameterization. A...
CVE-2026-69136
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, email template attachment handling passes the removeattachment POST parameter array through HTML-oriented securexss processing and directly interpolates its elements...
CVE-2026-63215
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the REST API v4.1 getentrylist method is vulnerable to time-based blind SQL injection when an authenticated caller simultaneously bypasses two independent security...
CVE-2026-69141 SuiteCRM: SQL injection via search param in modules/Cases/controller.php
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the CasesController actiongetkbarticles action interpolates $POST'search' into a CASE WHEN ... LIKE expression and the SQL WHERE clause. Although securexss normally...
EUVD-2026-117665
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the CasesController actiongetkbarticles action interpolates $POST'search' into a CASE WHEN ... LIKE expression and the SQL WHERE clause. Although securexss normally...
CVE-2026-69136 SuiteCRM: Authenticated SQL Injection In handleAttachments function
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, email template attachment handling passes the removeattachment POST parameter array through HTML-oriented securexss processing and directly interpolates its elements...
CVE-2026-69136
SuiteCRM is vulnerable to an Authenticated SQL Injection in the handleAttachments function prior to versions 7.15.2 and 8.10.2 . The root cause is that the remove_attachment POST parameter array is processed using HTML-oriented securexss() processing and then directly interpolated into an SQL UPD...
CVE-2026-69135 SuiteCRM: Authenticated SQL Injection In Project Module
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the Project module interpolates the authenticated caller's duplicateId POST parameter directly into a SQL query without sanitization, quoting, or parameterization. A...
EUVD-2026-117660
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the Project module interpolates the authenticated caller's duplicateId POST parameter directly into a SQL query without sanitization, quoting, or parameterization. A...
CVE-2026-69135
The SuiteCRM CRM application is vulnerable to an authenticated SQL injection in the Project module prior to versions 7.15.2 and 8.10.2 . The root cause is the interpolation of the authenticated caller's duplicateId POST parameter directly into a SQL query without proper sanitization, quoting, or ...
CVE-2026-69135 SuiteCRM: Authenticated SQL Injection In Project Module
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the Project module interpolates the authenticated caller's duplicateId POST parameter directly into a SQL query without sanitization, quoting, or parameterization. A...
CVE-2026-63215
The SuiteCRM CRM software is vulnerable to a time-based blind SQL injection in the REST API v4.1 get_entry_list method prior to versions 7.15.2 and 8.10.2 . An authenticated caller can trigger this vulnerability by simultaneously bypassing two unspecified security mechanisms. Successful exploitat...
CVE-2026-63215 SuiteCRM: Time-Based Blind SQL Injection via REST API
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the REST API v4.1 getentrylist method is vulnerable to time-based blind SQL injection when an authenticated caller simultaneously bypasses two independent security...
EUVD-2026-115663
The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the trackingprovider parameter of the POST /wp-json/wc-ast/v3/orders//shipment-trackings REST endpoint in all versions up to, and including, 3.9. This is due to insufficient escaping on the...
CVE-2026-2613
The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the structure of SQL statements. A user with administrator privileges can exploit this by influencing the structure of executed SQL statements, enabling blind SQL injection to infer...