138 matches found
CVE-2025-14068: Improper Neutralization of Special Elements used in an SQL Command
The WPNakama plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 0.6.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...
CVE-2025-13090: Improper Neutralization of Special Elements used in an SQL Command
The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'search' parameter in all versions up to, and including, 1.4.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...
CVE-2025-12482: Improper Neutralization of Special Elements used in an SQL Command
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to SQL Injection via the ‘search’ parameter in all versions up to, and including, 1.2.35 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
CVE-2025-10748: Improper Neutralization of Special Elements used in an SQL Command
The RapidResult plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to, and including, 1.2. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...
PT-2025-42300
Name of the Vulnerable Software and Affected Versions WP jQuery Pager plugin versions through 1.4.0 Description The WP jQuery Pager plugin for WordPress is susceptible to SQL Injection through the 'ids' shortcode attribute parameter. This is due to inadequate escaping of user-supplied input and...
PT-2025-42309
Name of the Vulnerable Software and Affected Versions WP Google Map Plugin versions prior to 1.0 Description The WP Google Map Plugin for WordPress is susceptible to a blind SQL Injection issue. This is due to inadequate escaping of user-supplied input and insufficient preparation of existing SQL...
CVE-2025-10862: Improper Neutralization of Special Elements used in an SQL Command
The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2.1.3. This is due to insufficient escaping on the 'id' parameter and lack of sufficient preparation on...
EUVD-2023-34145
Malicious code in bioql PyPI...
EUVD-2024-33902
Malicious code in bioql PyPI...
EUVD-2022-1676
Malicious code in bioql PyPI...
EUVD-2023-23308
Malicious code in bioql PyPI...
EUVD-2023-57748
Malicious code in bioql PyPI...
CVE-2025-9199: Improper Neutralization of Special Elements used in an SQL Command
The Woo superb slideshow transition gallery with random effect plugin for WordPress is vulnerable to SQL Injection via the 'woo-superb-slideshow' shortcode in all versions up to, and including, 9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...
CVE-2025-52041: Improper Neutralization of Special Elements used in an SQL Command
In Frappe ERPNext 15.57.5, the function getstockbalancefor at erpnext/stock/doctype/stockreconciliation/stockreconciliation.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the inventorydimensionsdict parameter...
CVE-2025-52043: Improper Neutralization of Special Elements used in an SQL Command
In Frappe ERPNext v15.57.5, the function importcoa at erpnext/accounts/doctype/chartofaccountsimporter/chartofaccountsimporter.py is vulnerable to SQL injection, which allows an attacker to extract all information from databases by injecting a SQL query into the company parameter...
CVE-2025-10037: Improper Neutralization of Special Elements used in an SQL Command
The Featured Image from URL FIFU plugin for WordPress is vulnerable to SQL Injection via the getpostswithinternalfeaturedimage function in all versions up to, and including, 5.2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
CVE-2025-52048
In Frappe 15.x.x before 15.72.0 and 14.x.x before 14.96.10, in the function addtag at "frappe/desk/doctype/tag/tag.py" is vulnerable to SQL Injection, which allows an attacker to extract information from databases by injecting a SQL query into the "dt" parameter...
CVE-2025-6437: Improper Neutralization of Special Elements used in an SQL Command
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the ‘oid’ parameter in all versions up to, and including, 4.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQ...
CVE-2024-52969
An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability CWE-89 in FortiSIEM ersion 7.1.7 and below, version 7.1.0, version 7.0.3 and below, version 6.7.9 and below, 6.7.8, version 6.6.5 and below, version 6.5.3 and below, version 6.4.4 and below...
CVE-2023-2237
The WP Replicate Post plugin for WordPress is vulnerable to SQL Injection via the postid parameter in versions up to, and including, 4.0.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...