95258 matches found
CVE-2025-67649
CVE-2025-67649 affects PHP Jabbers – Car Rental Script. A SQL injection vulnerability arises from improper neutralization of user input in parameters used for sorting, enabling unauthenticated attackers to perform SQL Injection. The issue is fixed in version 4.1. If applying mitigations, upgrade ...
EUVD-2026-51510
A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean...
vulnerabilities in Adobe Campaign Classic
Adobe has identified vulnerabilities in Adobe Campaign Classic ACC. The first vulnerability relates to incorrect authorization in ACC’s core authorization mechanisms, allowing attackers to execute arbitrary code without any user interaction. This means that attackers can perform actions beyond th...
WordPress Web Directory Free plugin <= 1.7.13 - Unauthenticated SQL Injection vulnerability
Unauthenticated SQL Injection vulnerability discovered by Nhien Pham nhienit, thevietronin in WordPress Plugin Web Directory Free versions = 1.7.13...
CVE-2026-15381
The WP Go Maps WordPress plugin before 10.1.04 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...
CVE-2026-14333
The Demi WordPress plugin before 0.0.7 stores its full-site backup archives in a publicly accessible location under a predictable filename and without access protection, allowing unauthenticated attackers to download complete backups including the site database and its user password hashes...
EUVD-2026-51432
The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks...
CVE-2026-15381
The WP Go Maps WordPress plugin (versions before 10.1.04 ) is vulnerable to an unauthenticated SQL injection attack. The root cause is the failure to properly sanitise and escape a parameter before including it in a SQL query, specifically identified in the Markers REST filter . An unauthenticate...
EUVD-2026-51428
The WP Go Maps WordPress plugin before 10.1.04 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...
CVE-2026-14333 Demi - One Click Demo Import, Backup & Site Migration < 0.0.7 - Unauthenticated Sensitive Data Exposure via Public Backup Directory
The Demi WordPress plugin before 0.0.7 stores its full-site backup archives in a publicly accessible location under a predictable filename and without access protection, allowing unauthenticated attackers to download complete backups including the site database and its user password hashes...
EUVD-2026-51409
The Demi WordPress plugin before 0.0.7 stores its full-site backup archives in a publicly accessible location under a predictable filename and without access protection, allowing unauthenticated attackers to download complete backups including the site database and its user password hashes...
CVE-2026-14333
The Demi - One Click Demo Import, Backup & Site Migration WordPress plugin, in versions before 0.0.7 , is vulnerable to unauthenticated sensitive data exposure . The root cause is that the plugin stores full-site backup archives in a publicly accessible location using a predictable filename witho...
CVE-2026-14333 Demi - One Click Demo Import, Backup & Site Migration < 0.0.7 - Unauthenticated Sensitive Data Exposure via Public Backup Directory
The Demi WordPress plugin before 0.0.7 stores its full-site backup archives in a publicly accessible location under a predictable filename and without access protection, allowing unauthenticated attackers to download complete backups including the site database and its user password hashes...
CVE-2026-14333
The Demi WordPress plugin before 0.0.7 stores its full-site backup archives in a publicly accessible location under a predictable filename and without access protection, allowing unauthenticated attackers to download complete backups including the site database and its user password hashes...
CVE-2026-63221 CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when used with where() conditions
CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch substitutes bound values from where conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the...
[SECURITY] Fedora 43 Update: dokuwiki-20250514b-4.fc43
DokuWiki is a standards compliant, simple to use Wiki, mainly aimed at creati ng documentation of any kind. It has a simple but powerful syntax which makes su re the data-files remain readable outside the Wiki and eases the creation of structured texts. All data is stored in plain text files no...
SUSE CVE-2026-4370
A vulnerability was identified in Juju from version 3.2.0 until 3.6.19 and from version 4.0 until 4.0.4, where the internal Dqlite database cluster fails to perform proper TLS client and server authentication. Specifically, the Juju controller's database endpoint does not validate client...
SUSE CVE-2026-11401
An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to escalate privileges to those of another Amazon RDS user, including rdssuperuser, via a crafted function created by the...
SUSE SLED15 / SLES15 Security Update : perl-DBI (SUSE-SU-2026:3415-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3415-1 advisory. This update for perl-DBI fixes the following issues - CVE-2026-14380: unvalidated string eval interpolation of...