EUVD-2023-43715

Malicious code in bioql PyPI...

EUVD-2024-33749

Malicious code in bioql PyPI...

EUVD-2025-4697

Malicious code in bioql PyPI...

CVE-2025-6986

CVE-2025-6986 affects the WordPress plugin FileBird – WordPress Media Library Folders & File Manager (versions prior to 6.4.9). The vulnerability is an authenticated SQL Injection via the search parameter caused by insufficient escaping and poor SQL query preparation, allowing an attacker with Au...

CVE-2025-7036

CVE-2025-7036 affects the CleverReach WordPress plugin (CleverReachWP) for WordPress, with unauthenticated, time-based SQL injection via the title parameter in all versions up to 1.5.20. Root cause: insufficient escaping of user input and insufficient preparation of the existing SQL query. Impact...

PT-2025-32034 · WordPress · Filebird – Wordpress Media Library Folders & File Manager

Name of the Vulnerable Software and Affected Versions: FileBird – WordPress Media Library Folders & File Manager versions prior to 6.4.9 Description: The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress contains a SQL Injection issue due to insufficient escaping of t...

CVE-2025-6717

The B1.lt plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 2.2.56 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated...

CVE-2021-4458

The Modern Events Calendar Lite plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'wpajaxmecloadsinglepage' AJAX action in all versions up to, and including, 6.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2021-4458 Modern Events Calendar Lite <= 6.3.0 - Unauthenticated SQL Injection

The Modern Events Calendar Lite plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'wpajaxmecloadsinglepage' AJAX action in all versions up to, and including, 6.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2025-6739

The WPQuiz plugin for WordPress is vulnerable to SQL Injection via the 'id' attribute of the 'wpquiz' shortcode in all versions up to, and including, 0.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2025-6783

CVE-2025-6783 (GoZen Forms, WordPress) is an unauthenticated SQL injection in the GoZen Forms plugin for WordPress (versions

PT-2025-27852 · WordPress · Gozen Forms

Name of the Vulnerable Software and Affected Versions: GoZen Forms plugin for WordPress versions up to, and including, 1.1.5 Description: The issue allows unauthenticated attackers to perform SQL Injection via the forms-id parameter of the emdedSc function due to insufficient escaping on the...

CVE-2025-6437

The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the ‘oid’ parameter in all versions up to, and including, 4.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQ...

CVE-2025-4381 Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated SQL Injection

The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the ‘$id’ variable of the getSpace function in all versions up to, and including, 4.89 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2025-5673

The CVE-2025-5673 entry concerns WordPress Blog2Social: Social Media Auto Post & Scheduler plugin. Affected versions up to 8.4.4 are vulnerable to SQL Injection via the prgSortPostType parameter, caused by insufficient escaping of user input and inadequate query preparation. This allows authentic...

CVE-2025-4964

CVE-2025-4964 applies to WP Online Users Stats for WordPress, with a time-based SQL Injection via the table_name parameter in all versions up to 1.0.0. The root cause is insufficient escaping and lack of proper preparation in the existing SQL query, enabling authenticated attackers with Editor-le...

CVE-2025-5103

The Ultimate Gift Cards for WooCommerce plugin for WordPress is vulnerable to boolean-based SQL Injection via the 'defaultprice' and 'productid' parameters in all versions up to, and including, 3.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

CVE-2025-5103

CVE-2025-5103 affects the WordPress plugin Ultimate Gift Cards for WooCommerce. Many versions up to 3.1.4 are vulnerable to boolean-based SQL injection via the default_price and product_id parameters due to insufficient escaping and lack of prepared statements. Exploitation requires Administrator...

CVE-2025-5287

The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

CVE-2025-5287

The CVE-2025-5287 vulnerability affects the WordPress plugin Likes and Dislikes (≤ 1.0.0). Root cause: insufficient escaping / lack of prepared statements in the SQL queries used by the my_likes_dislikes_action/ajax flow, allowing unauthenticated SQL injection via the post parameter. Impact: atta...