CVE-2026-65877

Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder 6.7.1 - Improper validation of various parameters in the media manager search and date filters lead to an SQL injection vector...

Exploit for SQL Injection in Wordpress

No d...

PT-2026-65303

Name of the Vulnerable Software and Affected Versions Dede CMS version 5.7.118 Description A SQL injection issue exists in the sys sql query.php component. A remote attacker can exploit this by sending crafted data to the sqlquery parameter to obtain sensitive information. SQL injection is a...

PT-2026-65143

Name of the Vulnerable Software and Affected Versions macOS Sequoia versions prior to 15.7.8 macOS Sonoma versions prior to 14.8.8 macOS Tahoe versions prior to 26.6 Description An injection issue exists where an application may be able to gain root privileges due to insufficient validation...

PT-2026-64973

SQL injection vulnerability exists in the order by parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments = 1.5.1. The vulnerability arises from unsanitized user input passed to the order by method of the CodeIgniter Query Builder, enabling attackers to perform time-based...

CVE-2026-65707 Likeshop 3.0.5 Authenticated SQL Injection via adjustAccount Endpoint

Likeshop through 3.0.5 contains an authenticated SQL injection vulnerability that allows admin-level users to extract arbitrary database contents by submitting unsanitized POST parameters to the adjustAccount endpoint. The adjustAccount method in UserLogic.php concatenates the money, integral,...

CVE-2026-65526

The CVE-2026-65526 entry concerns the WordPress Visualizer plugin (versions up to and including 4.0.6). The vulnerability is described as a Contributor SQL Injection in Visualizer

CVE-2026-65493

The CVE-2026-65493 entry concerns the WordPress Dokan Pro plugin (

CVE-2026-65462

CVE-2026-65462 affects WordPress plugin Uncanny Automator up to version 7.3.2. The issue is an SQL Injection triggered via administrator context. The CVSS data indicates high confidentiality impact and a local/private exposure path with network scope and no user interaction required, but no expli...

EUVD-2026-48207

Unauthenticated SQL Injection in Bookly = 27.7 versions...

WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin MapSVG versions = 8.14.0...

EUVD-2026-47703

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Xpoda Türkiye Informatics Technology Inc. No Code Platform allows SQL Injection. This issue affects No Code Platform: from 4.3.1.0 through 20260722. NOTE: The vendor was contacted early about this...

CVE-2026-2395

Technical details are not publicly available in the provided documents. No specifics on affected components, versions, or fix are included here. Monitor for updates from the vendor and security advisories.

EUVD-2026-46358

An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database...

CVE-2026-64880

Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries, enabling blind SQL injection and unauthorized database read access...

CVE-2026-64880

Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries, enabling blind SQL injection and unauthorized database read access...

CVE-2026-55082 DHIS2 SQL injection in SQL View filter values

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. DHIS2 SQL View data endpoints allowed authenticated users with SQL View access to provide crafted filter values that were interpolated into generated SQL. An authenticated user with acces...

USN-8578-1: CUPS control character injection vulnerability

It was discovered that CUPS did not properly filter control characters in IPP string attributes and PPD keywords. An unauthenticated attacker could exploit this to execute arbitrary code as the lp user on systems with shared target queues...

CVE-2026-52470

SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the RecordStateMapper.xml file...

EUVD-2026-45443

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. This impacts an unknown function of the file /editsubject.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed...