CVE-2026-15963

The Quiz and Survey Master QSM – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via 'randoncategory' Quiz Option in all versions up to, and including, 11.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...

EUVD-2026-59866

The Quiz and Survey Master QSM – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via 'randoncategory' Quiz Option in all versions up to, and including, 11.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...

CVE-2026-15963

The CVE-2026-15963 entry concerns the WordPress plugin Quiz and Survey Master (QSM). It describes a generic SQL injection via the 'randon_category' option affecting all versions up to 11.2.1, caused by insufficient escaping of user-supplied parameters and inadequate preparation of the SQL query. ...

CVE-2026-15963 Quiz and Survey Master (QSM) <= 11.2.1 - Authenticated (Contributor+) SQL Injection via 'randon_category' Quiz Option

The Quiz and Survey Master QSM – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via 'randoncategory' Quiz Option in all versions up to, and including, 11.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...

CVE-2026-16079 Fullscreen Galleria <= 1.6.12 - Authenticated (Contributor+) SQL Injection via 'href' Attribute in Post Content

The Fullscreen Galleria plugin for WordPress is vulnerable to generic SQL Injection via 'href' Attribute in Post Content in all versions up to, and including, 1.6.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This make...

EUVD-2026-59857

The Fullscreen Galleria plugin for WordPress is vulnerable to generic SQL Injection via 'href' Attribute in Post Content in all versions up to, and including, 1.6.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This make...

CVE-2026-16079

The CVE concerns the WordPress Fullscreen Galleria plugin (

CVE-2026-16079

The Fullscreen Galleria plugin for WordPress is vulnerable to generic SQL Injection via 'href' Attribute in Post Content in all versions up to, and including, 1.6.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This make...

EUVD-2026-59792

Pandora contains a path traversal vulnerability in its TAR archive extraction functionality. When processing a submitted TAR archive, the extractor passed archive member names directly to Python's tarfile.TarFile.extract without applying an extraction filter. An attacker able to submit a speciall...

PT-2026-73116

Name of the Vulnerable Software and Affected Versions The School Management – Education & Learning ERP plugin for WordPress versions prior to 5.5 Description Authenticated attackers with custom-level access and above can perform SQL Injection by appending additional queries to existing ones to...

PT-2026-73106

Name of the Vulnerable Software and Affected Versions WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors versions prior to 2.7.1 Description An issue exists where authenticated attackers with shop manager-level access or higher can perform a generic SQL Injection. This...

PT-2026-73094

Name of the Vulnerable Software and Affected Versions Fullscreen Galleria versions prior to 1.6.13 Description The Fullscreen Galleria plugin for WordPress contains a SQL Injection flaw. This occurs because of insufficient escaping of user-supplied parameters and a lack of proper preparation of t...

CVE-2026-15963: Improper Neutralization of Special Elements used in an SQL Command

The Quiz and Survey Master QSM – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via 'randoncategory' Quiz Option in all versions up to, and including, 11.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...

CVE-2026-16079: Improper Neutralization of Special Elements used in an SQL Command

The Fullscreen Galleria plugin for WordPress is vulnerable to generic SQL Injection via 'href' Attribute in Post Content in all versions up to, and including, 1.6.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This make...

CVE-2026-74251: Improper Neutralization of Special Elements used in an SQL Command

Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6 - The a attribute and s specification GET array parameters on Phoca Cart's public shop items page are concatenated raw into SQL WHERE clauses without parameterization or escaping. An...

PT-2026-73150

Name of the Vulnerable Software and Affected Versions Phoca Cart versions 5.0.0 through 6.1.16 Description An unauthenticated attacker can perform a SQL injection on the public shop items page. The issue occurs because the GET array parameters a attribute and s specification are concatenated...

PT-2026-73093

Name of the Vulnerable Software and Affected Versions Quiz and Survey Master QSM – Easy Quiz and Survey Maker versions prior to 11.2.2 Description The plugin is subject to a generic SQL Injection, a technique where malicious SQL statements are inserted into entry fields for execution. This occurs...

CVE-2026-74764

Pandora contains a path traversal vulnerability in its TAR archive extraction functionality. When processing a submitted TAR archive, the extractor passed archive member names directly to Python's tarfile.TarFile.extract without applying an extraction filter. An attacker able to submit a speciall...

CVE-2026-74767 Unbounded DAA Decompression in Pandora Allows Denial of Service via Decompression Bomb

Pandora contains a denial-of-service vulnerability in its handling of DAA Direct Access Archive files. When extracting the internal ISO image from a DAA archive, compressed chunks were decompressed using zlib.decompress without enforcing a limit on the resulting uncompressed data. An attacker abl...

CVE-2026-74767

Pandora has a DoS in DAA extraction: unbounded decompression of DAA chunks caused memory and CPU exhaustion. The fix uses bounded decompression (decompressobj().decompress()) with max_extracted_filesize, checks cumulative decompressed size, and raises a ZipBomb when the limit is exceeded, abortin...