483494 matches found
CVE-2026-83772 Cobham SATCOM VSAT7090 Maritime Satellite Router JSON Parsing mail-report.sh c_set_reports_decode command injection
A vulnerability was detected in Cobham SATCOM VSAT7090 Maritime Satellite Router up to 20260704. This issue affects the function csetreportsdecode of the file mail-report.sh of the component JSON Parsing. The manipulation of the argument sender/recipients results in command injection. It is...
EUVD-2026-68984
A vulnerability was detected in Cobham SATCOM VSAT7090 Maritime Satellite Router up to 20260704. This issue affects the function csetreportsdecode of the file mail-report.sh of the component JSON Parsing. The manipulation of the argument sender/recipients results in command injection. It is...
CVE-2026-83772
Cobham SATCOM VSAT7090 Maritime Satellite Router versions up to 20260704 are affected by a command injection vulnerability in the JSON Parsing component. The root cause lies in the function c_set_reports_decode within the file mail-report.sh , where unsanitized manipulation of the sender/recipien...
CVE-2026-77189 Charitable <= 1.8.12.1 - Authenticated (Contributor+) SQL Injection via 'order' Shortcode Attribute
The Charitable – Donation & Fundraising Platform Donation Forms, Recurring Donations & Fundraising Campaigns plugin for WordPress is vulnerable to generic SQL Injection via 'order' Shortcode Attribute in all versions up to, and including, 1.8.12.1 due to insufficient escaping on the user supplied...
EUVD-2026-68983
The Charitable – Donation & Fundraising Platform Donation Forms, Recurring Donations & Fundraising Campaigns plugin for WordPress is vulnerable to generic SQL Injection via 'order' Shortcode Attribute in all versions up to, and including, 1.8.12.1 due to insufficient escaping on the user supplied...
CVE-2026-77189
The Charitable WordPress plugin (Donation & Fundraising Platform) is vulnerable to SQL Injection via the 'order' attribute of the [charitable_donors] shortcode in all versions up to and including 1.8.12.1 . The root cause is insufficient escaping of the user-supplied parameter combined with a lac...
CVE-2026-76006
The Photo Gallery by Ays – Responsive Image Gallery plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 6.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...
CVE-2026-77823
The LearnPress plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the exportordercsv AJAX action in versions up to, and including, 4.4.4. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...
CVE-2026-18752
The Persistent Login plugin for WordPress is vulnerable to generic SQL Injection via 'wppldeviceid' Cookie in all versions up to, and including, 3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...
CVE-2026-17589
The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to generic SQL Injection via the 'productorder' parameter in all versions up to, and including, 5.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...
CVE-2026-77823 LearnPress <= 4.4.4 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
The LearnPress plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the exportordercsv AJAX action in versions up to, and including, 4.4.4. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...
EUVD-2026-68979
The LearnPress plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the exportordercsv AJAX action in versions up to, and including, 4.4.4. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...
CVE-2026-77823
The LearnPress WordPress plugin (versions ≤ 4.4.4 ) is vulnerable to SQL injection via the orderby parameter in the export_order_csv AJAX action. The root cause is insufficient escaping: only the literal values date and title are normalized, while any other attacker-controlled string is concatena...
CVE-2026-13203 Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_id' Shortcode Attribute
The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customid' shortcode attribute of the dslcmodulessection and dslcmodulesarea shortcodes in versions up to, and including, 2.1.19. This is due to insufficient input...
CVE-2026-76006 Photo Gallery by Ays <= 6.8.2 - Authenticated (Administrator+) SQL Injection via 's' Parameter
The Photo Gallery by Ays – Responsive Image Gallery plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 6.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...
EUVD-2026-68974
The Photo Gallery by Ays – Responsive Image Gallery plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 6.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...
CVE-2026-76006
Photo Gallery by Ays (WordPress plugin) versions up to and including 6.8.2 are vulnerable to SQL Injection via the 's' parameter . The root cause is insufficient escaping and lack of query preparation on user-supplied input across two execution paths: $wpdb->get_var() in record_count() and $wp...
EUVD-2026-68971
The Persistent Login plugin for WordPress is vulnerable to generic SQL Injection via 'wppldeviceid' Cookie in all versions up to, and including, 3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...
CVE-2026-17589
The Shopping Cart & eCommerce Store (WP EasyCart) plugin for WordPress is vulnerable to a second-order SQL injection via the product_order parameter in versions up to 5.9.2 . The payload is written to the ec_pageoption table via the ec_ajax_save_page_options handler with no sanitization on raw $_...
EUVD-2026-68970
The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to generic SQL Injection via the 'productorder' parameter in all versions up to, and including, 5.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...