639 matches found
CVE-2026-85198: Improper Neutralization of Special Elements used in an SQL Command
The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin for WordPress is vulnerable to generic SQL Injection via URL Path in all versions up to, and including, 4.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
CVE-2026-19778
The WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping plugin for WordPress is vulnerable to time-based SQL Injection via the 'feed' parameter in all versions up to, and including, 2.23.7 due to insufficient escaping on the user supplied parameter and lack of...
PT-2026-88871
The Quentn WP WordPress plugin before 1.2.15 does not adequately escape a request parameter before using it in an unprepared SQL query, allowing unauthenticated attackers to extract arbitrary data from the database via SQL injection...
CVE-2026-19778: Improper Neutralization of Special Elements used in an SQL Command
The WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping plugin for WordPress is vulnerable to time-based SQL Injection via the 'feed' parameter in all versions up to, and including, 2.23.7 due to insufficient escaping on the user supplied parameter and lack of...
PT-2026-88857
The ELEX WooCommerce Request a Quote WordPress plugin before 2.4.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks and extract arbitrary data from the database...
CVE-2026-19800: Improper Neutralization of Special Elements used in an SQL Command
The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to SQL Injection via the 'status' parameter in all versions up to, and including, 1.31.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...
CVE-2026-82655: Improper Neutralization of Special Elements used in an SQL Command
Admidio before 5.0.12 contains a blind SQL injection vulnerability in the relationtypelist parameter of listsshow.php that allows unauthenticated attackers to execute arbitrary SQL queries. Attackers can bypass authentication by providing a dummy UUID in rolelist and inject SQL through...
CVE-2020-15878
An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via a SQL injection in the address parameter in the /ajaxtable.php API endpoint...
CVE-2020-15876
A SQL injection vulnerability exists in LibreNMS 1.65 within the sort parameter of the /ajax_table.php API endpoint. A remote authenticated attacker with normal privileges can exploit this flaw to extract all information from the LibreNMS database . The vulnerability impacts numerous files, inclu...
CVE-2020-15876: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via a SQL injection in the sort parameter in the /ajaxtable.php API endpoint. This affects address-search.inc.php, alertlog.inc.php,...
EUVD-2020-31268
An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via a SQL injection in the sort parameter in the /ajaxtable.php API endpoint. This affects address-search.inc.php, alertlog.inc.php,...
CVE-2026-78468
...
CVE-2026-78470 WP Project Manager Pro <= 4.0.1 - Authenticated (Subscriber+) SQL Injection
The WP Project Manager Pro plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers,...
CVE-2026-78468: Undefined Security Weakness
The FluentCRM Pro – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 3.1.12 due to insufficient escaping on the user supplied parameter and lack of sufficient...
CVE-2026-77824: Improper Neutralization of Special Elements used in an SQL Command
The Media Sweep – WordPress Media Cleaner plugin for WordPress is vulnerable to generic SQL Injection via the 'fields' parameter in all versions up to, and including, 1.1.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...
SQL Injection
Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to SQL Injection in the ipaddress parameter of the Admins.add or Admins.update process. An attacker can extract sensitive database information, including administrator login names and...
CVE-2026-74251
Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6 - The a attribute and s specification GET array parameters on Phoca Cart's public shop items page are concatenated raw into SQL WHERE clauses without parameterization or escaping. An...
EUVD-2026-59941
Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6 - The a attribute and s specification GET array parameters on Phoca Cart's public shop items page are concatenated raw into SQL WHERE clauses without parameterization or escaping. An...
CVE-2026-2497
The CVE concerns The Gallery by BestWebSoft plugin for WordPress, affecting all versions up to 4.7.9. The vulnerability is an SQL Injection via the gallery_order {post_id} parameter array keys, arising from unsanitized array keys stored from $_POST into post meta and later injected into SQL queri...