CVE-2026-18443

The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via the 'accessprivileges' parameter in all versions up to, and including, 8.97.0 due to insufficient escaping on the user supplied parameter and lack of sufficien...

CVE-2026-18443

The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress (versions up to and including 8.97.0 ) is vulnerable to SQL Injection via the 'access_privileges' parameter. The root cause is insufficient escaping of user-supplied input and a lack of sufficient prepa...

proteus

Proteus Proteus - axiom 데이터베이스 및 API https://github.com/pry0cc/axiom. 원래 ProjectDiscovery 도구를 사용하여 ASM 플랫폼 구성하기를 위해 작성되었습니다. 설정 먼저 저장소를 클론합니다. git clone https://github.com/pry0cc/proteus /.proteus cd /.proteus 다음으로, Slack 웹훅을 포함하도록 config/notify.yaml을 수정하세요. bin 디렉토리로 이동하여 docker-compose.yml의...

Teamsniper

Teamsniper Teamsniper는 Microsoft Teams에서 비밀번호, 이메일, 데이터베이스 등 키워드를 검색하기 위한 도구입니다. 사용법 도움말 옵션 usage: Teamsniper.py -h -d DATABASE -a AUTHTOKEN -s SEARCH Teamsniper is a tool for fetching the given keywords in Microsoft Teams. options: -h, --help show this help message and exit -d DATABASE, --databa...

CVE-2026-92923 Unlimited Elements For Elementor 1.5.142 - 2.0.20 - Subscriber+ SQLi via get_addon_output_data

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise and escape a parameter before using it in a SQL statement, allowing users with a role as low as subscriber to perform blind SQL injection attacks and read arbitrary data from the database. Version 2.0.18 removed...

EUVD-2026-91943

The SaveTo Wishlist Lite WordPress plugin before 1.1.5 does not sanitise and escape parameters before using them in the ORDER BY clause of a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database...

CVE-2026-92923 Unlimited Elements For Elementor 1.5.142 - 2.0.20 - Subscriber+ SQLi via get_addon_output_data

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise and escape a parameter before using it in a SQL statement, allowing users with a role as low as subscriber to perform blind SQL injection attacks and read arbitrary data from the database. Version 2.0.18 removed...

[SECURITY] Fedora 45 Update: prometheus-3.15.0-1.fc45

The Prometheus monitoring system and time series database...

CVE-2026-94539

The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to time-based SQL Injection via the 'sortby' parameter in all versions up to, and including, 3.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-94539 SupportCandy <= 3.5.3 - Authenticated (Custom+) SQL Injection via 'sort_by' Parameter

The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to time-based SQL Injection via the 'sortby' parameter in all versions up to, and including, 3.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-95865

The Beaver Builder Page Builder plugin for WordPress is vulnerable to blind SQL Injection in all versions up to and including 2.11.0.5 . The root cause is insufficient escaping of the fields[][value] parameter and a lack of sufficient preparation on the existing SQL query. Authenticated attackers...

CVE-2026-95865 Beaver Builder Page Builder <= 2.11.0.5 - Authenticated (Contributor+) SQL Injection via 'fields[][value]' Parameter

The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to blind SQL Injection via 'fieldsvalue' Parameter in all versions up to, and including, 2.11.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...

EUVD-2026-91875

The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to blind SQL Injection via 'fieldsvalue' Parameter in all versions up to, and including, 2.11.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...

PrestaShop SmartBlog <4.0.6 - SQL Injection

PrestaShop SmartBlog by SmartDataSoft 4.0.6 is vulnerable to a SQL injection vulnerability in the blog archive functionality. id: CVE-2021-37538 info: name: PrestaShop SmartBlog 4.0.6 - SQL Injection author: whoever severity: critical description: PrestaShop SmartBlog by SmartDataSoft 4.0.6 is...

VICIdial - SQL Injection

An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records. By default, VICIdial stores plaintext credentials within the database. id: CVE-2024-8503 info: name: VICIdial - SQL Injection author: s4e-io severity: critical description:...

LearnPress < 4.2.7.1 - SQL Injection

The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'conlyfields' parameter of the /wp-json/learnpress/v1/courses REST API endpoint in all versions up to, and including, 4.2.7 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2025-69295

CVE-2025-69295 — TeconceTheme Coven Core 블라인드 SQL 인젝션 취약점 CVE-2025-69295는 TeconceTheme Coven Core WordPress 테마의 Coven Core 컴포넌트에 영향을 미치는 SQL 인젝션 취약점입니다. 이 취약점은 사용자 제공 입력이 SQL 쿼리에 사용되기 전에 적절히 중화되지 않아 공격자가 백엔드 데이터베이스 쿼리에 악성 SQL 명령을 주입할 수 있게 함으로써 존재합니다. 이 취약점은 특히 블라인드 SQL 인젝션을 가능하게 하며, 공격자는 조작된 요청을...

[SECURITY] Fedora 45 Update: pgmodeler-1.2.2-4.fc45

PostgreSQL Database Modeler, or simply, pgModeler is an open source tool for modeling databases that merges the classical concepts of entity-relationship diagrams with specific features that only PostgreSQL implements. The pgModeler translates the models created by the user to SQL code and apply...

[SECURITY] Fedora 45 Update: osinfo-db-tools-1.12.0-10.fc45

This package provides tools for managing the osinfo database of information about operating systems for use with virtualization...

EUVD-2026-91833

Armatura One's database initialization routine assigns a fixed, vendor-defined password to the database superuser account at creation time, rather than generating a unique password per installation. An individual with access to the server operating system and knowledge of this value can...