481418 matches found
CVE-2026-81756
Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms = 5.1.24 versions...
CVE-2026-81293
Unauthenticated SQL Injection in WP Data Access = 5.5.81 versions...
CVE-2026-79483
FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attacker can inject malicious NoSQL operators via crafted JSON payloads to bypass authorization checks, resulting in unauthorized access to chat...
CVE-2026-79408
An OS command injection vulnerability in MetaGPT 0.8.1 allows an attacker to execute arbitrary commands via the path argument of RepoParser.rebuildclassviews in metagpt/repoparser.py...
CVE-2026-81287
Subscriber SQL Injection in Charitable = 1.8.12.1 versions...
Command Injection
Overview @snyk/sweater-comb is a “Sweats the small stuff, so you don’t have to. OpenAPI linting rules for Snyk APIs.” Affected versions of this package are vulnerable to Command Injection through the expectGitBranch function in src/lint.ts. An attacker can execute arbitrary OS commands by supplyi...
CVE-2025-60876
CVE-2025-60876: busybox wget request-target injection fix A behavior-preserving fix for CVE-2025-60876, an HTTP header-injection vulnerability in BusyBox wget, plus the proof-of-concept that demonstrates it and the artifacts for submitting the fix upstream to BusyBox. The vulnerability BusyBox wg...
CVE-2026-82914
kishan0725 Hospital-Management-System 1.0 contains a SQL injection vulnerability in the file /search.php , triggered by manipulation of the Contact argument. The flaw allows a remote, unauthenticated attacker to execute arbitrary SQL queries, resulting in low impact on confidentiality, integrity,...
EUVD-2026-68807
A security flaw has been discovered in kishan0725 Hospital-Management-System 1.0. This vulnerability affects unknown code of the file /search.php. The manipulation of the argument Contact results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the...
CVE-2026-82226
This CVE affects the Tickera (Event Ticketing System) WordPress plugin, versions 3.6.0.2 and below . The vulnerability is an unauthenticated PHP Object Injection , rated CVSS 9.8 (Critical) with a network attack vector requiring no privileges or user interaction, and high impact on confidentialit...
CVE-2026-82226 WordPress Tickera plugin <= 3.6.0.2 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Tickera = 3.6.0.2 versions...
EUVD-2026-68796
Unauthenticated PHP Object Injection in Tickera = 3.6.0.2 versions...
EUVD-2026-68794
Unauthenticated Cross Site Scripting XSS in SliceWP = 1.2.10 versions...
CVE-2026-82221 WordPress RegistrationMagic plugin <= 6.0.9.8 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in RegistrationMagic = 6.0.9.8 versions...
CVE-2026-81763 WordPress Throws SPAM Away plugin <= 3.8.2 - SQL Injection vulnerability
Unauthenticated SQL Injection in Throws SPAM Away = 3.8.2 versions...
EUVD-2026-68787
Unauthenticated SQL Injection in Throws SPAM Away = 3.8.2 versions...
CVE-2026-81763
CVE-2026-81763 is an unauthenticated SQL injection vulnerability in the WordPress plugin Throws SPAM Away (versions ≤ 3.8.2 ), discovered by Jiemook . The flaw allows a network-based attacker with no privileges to inject SQL queries, leading to a High impact on confidentiality and a Low impact on...
CVE-2026-81756
An unauthenticated SQL injection vulnerability exists in the WordPress plugin Smart Marketing SMS and Newsletters Forms in versions