CVE-2026-11920

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

CVE-2026-11969

The vulnerability (CVE-2026-11969) affects the WordPress plugin WP TripAdvisor Review Slider up to version 14.3 . The issue is a SQL Injection via the 'curselrevs[]' parameter caused by insufficient escaping and inadequate preparation of the SQL query. Attack feasibility requires authenticated ac...

EUVD-2026-53286

The WP TripAdvisor Review Slider plugin for WordPress is vulnerable to generic SQL Injection via 'curselrevs' Parameter in all versions up to, and including, 14.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes i...

CVE-2026-11969

The WP TripAdvisor Review Slider plugin for WordPress is vulnerable to generic SQL Injection via 'curselrevs' Parameter in all versions up to, and including, 14.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes i...

EUVD-2026-53118

The Ajax Load More WordPress plugin before 8.0.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to perform time-based blind SQL injection and extract sensitive data from the database...

CVE-2026-11421 ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support <= 1.17.4 - Authenticated (Custom+) SQL Injection via 'erpadvancefilter' Parameter

The ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support plugin for WordPress is vulnerable to SQL Injection via the 'erpadvancefilter' parameter in all versions up to, and including, 1.17.4 due to insufficient escaping on the user supplied parameter and lack of sufficient...

PT-2026-68058

Name of the Vulnerable Software and Affected Versions JoomSport – for Sports: Team & League, Football, Hockey & more versions prior to 5.7.10 Description This issue is a time-based SQL Injection, a technique used to infer data from a database by observing the time it takes for the server to respo...

PT-2026-68262

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 2.576 Jenkins LTS versions prior to 2.568.2 Description Jenkins fails to safely handle symbolic links with effectively empty names when extracting .tar and .tar.gz archives. This allows attackers who control agent...

PT-2026-68103

Name of the Vulnerable Software and Affected Versions Miantang/IoT-PHP affected versions not specified Description The index.php file implements a POST '/userlogin' endpoint that is susceptible to SQL injection. The application reads the password from the pwd variable without sanitization and...

CVE-2026-11969: Improper Neutralization of Special Elements used in an SQL Command

The WP TripAdvisor Review Slider plugin for WordPress is vulnerable to generic SQL Injection via 'curselrevs' Parameter in all versions up to, and including, 14.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes i...

CVE-2026-5651: Improper Neutralization of Special Elements used in an SQL Command

The Askeet plugin for WordPress is vulnerable to SQL Injection via the 'sqlquery' parameter in multiple AJAX actions askeetexecutesqlquery, askeetexportallresults in all versions up to, and including, 3.0. This is due to the askeetissafequery filter being bypassable using MySQL conditional commen...

CVE-2026-5062: Improper Neutralization of Special Elements used in an SQL Command

The PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin plugin for WordPress is vulnerable to SQL Injection via the 's' search parameter on the Pretty Links listing page in all versions up to, and including, 3.6.20. This is due to insufficient escapin...

CVE-2026-71237: Improper Neutralization of Special Elements used in an SQL Command

Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from 'pwd' with no sanitization and concatenates it into a raw SQL string: mysqlquery"select from userlists where username='' and password='' limit 1". An unauthenticated attacker can submit a payload...

CVE-2026-11421: Improper Neutralization of Special Elements used in an SQL Command

The ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support plugin for WordPress is vulnerable to SQL Injection via the 'erpadvancefilter' parameter in all versions up to, and including, 1.17.4 due to insufficient escaping on the user supplied parameter and lack of sufficient...

Link following vulnerability allows arbitrary file creation

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives. This allows attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary...

XXE vulnerability in ivy-report

ivy-report 1.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control workspace contents to have Jenkins parse a crafted Ivy report XML file that uses external entities for extraction of secrets from the Jenkins controller o...

PT-2026-68989

Impact When a page is covered by routeRules cache / swr / isr, Nuxt enables runtime payload extraction and serves // payload.json. On affected versions the renderer stored the SSR payload in the shared cache:nuxt:payload storage under a path-only key no cookie, authorization, or cache.varies...

CVE-2026-70427: Improper Link Resolution Before File Access

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, allowing attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary...

PT-2026-68573

Name of the Vulnerable Software and Affected Versions Iptanus File Upload versions prior to 5.1.8 Description An unauthenticated SQL Injection exists due to insufficient escaping of user-supplied parameters and a lack of proper preparation of SQL queries. This allows attackers to append additiona...

CVE-2026-69704

Atals-Livre contains a SQL injection vulnerability that allows attackers to manipulate database queries by passing unsanitized input through a GET parameter to the supp deletion helper function. Attackers can inject malicious SQL syntax via the vulnerable GET parameter to perform unauthorized...