OpenClaw has an unspecified vulnerability (CNVD-2026-14830)

OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw suffers from a security vulnerability that stems from not consistently applying sender policy checks to reaction and pin non-message events, which can be exploited by an attacker to cause the injection of...

Nesote Inout Article Base CMS SQL注入漏洞

Nesote Inout Article Base CMS is a content management system developed by the Indian company Nesote, designed for building article publishing and content management websites. The Inout Article Base CMS has a SQL injection vulnerability. This vulnerability stems from SQL injection attacks, allowin...

NetArt Media Vlog System SQL注入漏洞

NetArt Media Vlog System is a platform system developed by NetArt Media in Bulgaria, designed for building video blog websites and managing video content along with user interactions. The NetArt Media Vlog System has a SQL injection vulnerability. This vulnerability stems from SQL injection...

CVE-2026-33538: Uncontrolled Resource Consumption

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.58 and 9.6.0-alpha.52, an unauthenticated attacker can cause denial of service by sending authentication requests with arbitrary, unconfigured provider names. The server...

Zeeways Jobsite CMS SQL注入漏洞

Zeeways Jobsite CMS is a recruitment platform building tool developed by Zeeways Corporation. Zeeways Jobsite CMS has a SQL injection vulnerability. This vulnerability arises from SQL injection attacks, allowing unauthenticated attackers to inject SQL code through ID GET parameters and manipulate...

WordPress plugin Product Filter for WooCommerce by WBW 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that extends the...

PT-2026-27372

Meeplace Business Review Script contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send GET requests to the addclick.php endpoint with crafted SQL payloads in the 'id'...

Zabbix 安全漏洞

Zabbix is a set of open-source monitoring systems developed by Zabbix Inc. This system supports network monitoring, server monitoring, cloud monitoring, and application monitoring. Zabbix has security vulnerabilities; one of these vulnerabilities stems from SQL injection in the sortfield paramete...

PT-2026-27483

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.58 Parse Server versions prior to 9.6.0-alpha.52 Description An unauthenticated attacker can cause a denial of service by sending authentication requests with arbitrary, unconfigured provider names. The serve...

CVE-2026-4662: Improper Neutralization of Special Elements used in an SQL Command

The JetEngine plugin for WordPress is vulnerable to SQL Injection via the listingloadmore AJAX action in all versions up to, and including, 3.8.6.1. This is due to the filteredquery parameter being excluded from the HMAC signature validation allowing attacker-controlled input to bypass security...

CVE-2026-4614

CVE-2026-4614 : A vulnerability in itsourcecode sanitization/validation affects the Parameter Handler’s processing of /admin/subjects.php, where manipulation of the subject_code argument enables SQL injection. The issue can be exploited remotely and exploit details have been publicly disclosed. C...

CVE-2026-4613

SourceCodester E-Commerce Site 1.0 contains an SQL injection in the /products.php file triggered by the Search parameter. The vulnerability is exploitable remotely with a Proof-of-Concept exploit documented, affecting unknown code paths in the file. Reported CVSS metrics indicate high impact on c...

CVE-2026-4306

CVE-2026-4306 affects the WP Job Portal plugin for WordPress. It is a SQL Injection in the radius parameter in all versions up to 2.4.8 caused by insufficient escaping and lack of proper query preparation, enabling unauthenticated attackers to append SQL to existing queries and potentially extrac...

CVE-2026-4612

A vulnerability has been found in itsourcecode Free Hotel Reservation System 1.0. This affects an unknown part of the file /hotel/admin/modusers/index.php?view=edit&id=8 of the component Parameter Handler. The manipulation of the argument accountid leads to sql injection. Remote exploitation of t...

EUVD-2026-14516

MantisBT is vulnerable to authentication bypass through the SOAP API on MySQL...

GHSA-PHRQ-PC6R-F6GH MantisBT is vulnerable to authentication bypass through the SOAP API on MySQL

Mantis Bug Tracker instances running on MySQL and compatible databases are affected by an authentication bypass vulnerability in the SOAP API, as a result of improper type checking on the password parameter. Other database backends are not affected, as they do not perform implicit type conversion...

CVE-2026-33548

Mantis Bug Tracker MantisBT is an open source issue tracker. In version 2.28.0, improper escaping of tag names retrieved from History in Timeline myviewpage.php allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript, when displaying a tag that has...

CVE-2026-30849 MantisBT SOAP API has an authentication bypass vulnerability on MySQL

Mantis Bug Tracker MantisBT is an open source issue tracker. Versions prior to 2.28.1 running on MySQL family databases are affected by an authentication bypass vulnerability in the SOAP API, as a result of an improper type checking on the password parameter. Other database backends are not...

CVE-2026-30849

The CVE affects MantisBT (open source issue tracker) prior to version 2.28.1 when run on MySQL databases. It enables an authentication bypass via the SOAP API due to improper type checking on the password parameter, allowing an attacker who knows a victim’s username to log in without the password...

WordPress Fonts Manager | Custom Fonts plugin <= 1.2 - Unauthenticated SQL Injection via fmcfIdSelectedFnt parameter vulnerability

Unauthenticated SQL Injection via fmcfIdSelectedFnt parameter vulnerability discovered by Tarcísio Luchesi De Almeida Silva Poystick in WordPress Plugin Fonts Manager | Custom Fonts versions = 1.2...