WordPress VikRentCar Car Rental Management System SQL injection vulnerability

WordPress VikRentCar Car Rental Management System versions 1.4.10 and earlier contain an SQL injection vulnerability. This vulnerability stems from insufficient escaping of the catid parameter and inadequate preparation for existing SQL queries; it is susceptible to blind SQL injection attacks. A...

CVE-2026-63286: Axis Communications AB: Database backups are vulnerable to offline attacks

Database backups are vulnerable to offline attacks. Backups created using a version prior to the patched version are still vulnerable. AXIS Camera Station Pro automatically creates one more such backup for recovery purpose when the update is applied. Delete all these backups and change the...

Futurum Software User Authentication Module SQL injection vulnerability

Versions of the Futurum Software User Authentication Module prior to May 2026 contain an SQL injection vulnerability. This vulnerability stems from insufficient validation and sanitization of user-supplied input, as well as improper WAF configuration. It may allow unauthenticated attackers to...

PT-2026-128092

The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being stored in a popup text block and later evaluated by its template engine, because the filter meant to strip template delimiters runs before a decoding step that reconstructs them,...

PT-2026-127880

The WP Visitor Statistics Real Time Traffic plugin for WordPress is vulnerable to SQL Injection via the 'from' and sibling 'to'/'first'/'second' shortcode attribute of the wsm showTrafficStatsList shortcode in versions up to, and including, 8.8 This is due to insufficient escaping on the...

PT-2026-127797

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an information disclosure vulnerability that exposes database backups in the web-accessible /admin/backup directory. Unauthenticated attackers can list the directory or guess date-based names...

OpenCATS input validation error vulnerability

Versions prior to OpenCATS 0.10.0 contain a security vulnerability. This vulnerability stems from insufficient validation or escaping of the period, startDate, and endDate parameters in the activity DataGrid date filtering within modules/home/dataGrids.php and modules/activity/dataGrids.php. Thes...

MongoDB Database Tools encryption issue vulnerability

Versions of MongoDB Database Tools prior to 100.20.0 contain an encryption-related vulnerability. This vulnerability stems from the reliance on the TLS implementation within the Go standard library and the use of a system CA for storage; however, Go version 1.26.8 does not include the crypto/x509...

Content Sync (content-sync.io) - Moderately critical - Information disclosure - SA-CONTRIB-2026-291

This module enables you to share and reuse content across websites. The module did not sufficiently encrypt the password of the system user used when synchronizing content. This can potentially allow unprivileged users to view the password. This vulnerability is mitigated by the fact that an...

CVE-2026-61567: WWBN AVideo-Encoder: AVideo is a video-sharing Platform

AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint view/videosListToLive.php accepts an attacker-named streamer in webSiteRootURL, calls Login::run in objects/Login.php, and trusts the returned JSON as session state. An unauthenticated remote attacker who can host an...

CVE-2026-116609: osamaesh WP Visitor Statistics (Real Time Traffic): The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to SQL Injection via the 'from' (and…

The WP Visitor Statistics Real Time Traffic plugin for WordPress is vulnerable to SQL Injection via the 'from' and sibling 'to'/'first'/'second' shortcode attribute of the wsmshowTrafficStatsList shortcode in versions up to, and including, 8.8 This is due to insufficient escaping on the...

CVE-2026-115224: Unknown Customer Engagement System: The Customer Engagement System WordPress plugin before 2.0.2 does not safely build the SQL statements that store a…

The Customer Engagement System WordPress plugin before 2.0.2 does not safely build the SQL statements that store a popup's page and category visibility rules, concatenating request-supplied ID values directly into an INSERT statement with no parameter binding or integer cast, allowing an...

CVE-2026-61569: WWBN AVideo-Encoder: AVideo is a video-sharing Platform

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated streamer login at objects/login.json.php passes the user parameter to Streamer::get in objects/Streamer.php, where it is interpolated into a single-quoted MariaDB SELECT without parameterization or escaping. Although...

CVE-2026-76005: chuck1982 WP Inventory Manager: The WP Inventory Manager plugin for WordPress is vulnerable to time-based SQL Injection via 'sort_order' Shortcode…

The WP Inventory Manager plugin for WordPress is vulnerable to time-based SQL Injection via 'sortorder' Shortcode Attribute in all versions up to, and including, 2.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2026-58257

GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, the database restoration feature fails to enforce or validate file paths. A user with administrator privileges can manipulate the input to read or delete arbitrary files on the server,...

CVE-2026-58257

The GRR resource management and reservation application is vulnerable to Arbitrary File Read and Deletion prior to version 4.5.0 . The root cause is a failure to validate or enforce file paths within the database restoration feature . An attacker with administrator privileges can manipulate input...

EUVD-2026-111410

GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, the database restoration feature fails to enforce or validate file paths. A user with administrator privileges can manipulate the input to read or delete arbitrary files on the server,...

CVE-2026-58257 GRR vulnerable to Arbitrary File Read and Deletion

GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, the database restoration feature fails to enforce or validate file paths. A user with administrator privileges can manipulate the input to read or delete arbitrary files on the server,...

CVE-2026-58257 GRR vulnerable to Arbitrary File Read and Deletion

GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, the database restoration feature fails to enforce or validate file paths. A user with administrator privileges can manipulate the input to read or delete arbitrary files on the server,...

CVE-2026-58257 GRR vulnerable to Arbitrary File Read and Deletion

GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, the database restoration feature fails to enforce or validate file paths. A user with administrator privileges can manipulate the input to read or delete arbitrary files on the server,...