EUVD-2026-100813

Improper neutralization of special elements in the NetBird client SSH configuration manager client/ssh/config/manager.go in NetBird versions 0.60.0 through 0.74.6 allows a malicious or compromised peer to execute arbitrary commands on other NetBird client hosts. The client writes a system-wide...

CVE-2026-101926 Hyyan WooCommerce Polylang Integration <= 1.5.0 - Authenticated (Subscriber+) SQL Injection via 'variation_ids' Parameter

The Hyyan WooCommerce Polylang Integration plugin for WordPress is vulnerable to SQL Injection via the 'variationids' parameter of the 'woocommerceremovevariations' AJAX action in versions up to, and including, 1.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficie...

CVE-2026-101926

The Hyyan WooCommerce Polylang Integration plugin for WordPress is vulnerable to SQL Injection in versions up to and including 1.5.0 . The flaw exists in the woocommerce_remove_variations AJAX action due to insufficient escaping and lack of sufficient preparation on the user-supplied variation_id...

EUVD-2026-100812

The Hyyan WooCommerce Polylang Integration plugin for WordPress is vulnerable to SQL Injection via the 'variationids' parameter of the 'woocommerceremovevariations' AJAX action in versions up to, and including, 1.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficie...

CVE-2026-96661

The Gmedia Photo Gallery plugin for WordPress is vulnerable to time-based SQL Injection via the 'gmediain' parameter in all versions up to, and including, 1.25.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2026-95808

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via the 'inputs' parameter in all versions up to, and including, 1.15.48 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-78193

The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via 'product.push' Identity Endpoint in all versions up to, and including, 2.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...

CVE-2025-63420

CVE-2025-63420 CrushFTP11 before 11.3.757 is vulnerable to stored HTML injection in the CrushFTP Admin Panel Reports / "Who Created Folder", enabling persistent HTML execution in admin sessions. CWE CWE-79 — Improper Neutralization of Input During Web Page Generation Cross-site Scripting CVSS v3....

CVE-2025-69458

CVE-2025-69458 – Movie Rating System 1.0 SQLi to RCE Unauthenticated WriteUp CVE-2025-69458 – ExploitDB 50622...

Simulation_CVE-2024-46256

CVE-2024-46256 & CVE-2024-46257 – PoC Simulation Overview This repository contains a step-by-step, image-backed Proof of Concept PoC simulating two vulnerabilities in Nginx Proxy Manager that enable OS Command Injection, leading to Remote Code Execution RCE after authentication. Affected product:...

EUVD-2026-100797

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via the 'inputs' parameter in all versions up to, and including, 1.15.48 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-95808

The Form Maker by 10Web WordPress plugin (versions up to and including 1.15.48 ) is vulnerable to blind SQL Injection via the 'inputs' parameter . The root cause is insufficient escaping of user-supplied parameters and a lack of proper preparation in existing SQL queries. Unauthenticated attacker...

CVE-2026-95808 Form Maker by 10Web <= 1.15.48 - Unauthenticated SQL Injection via 'inputs' Parameter

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via the 'inputs' parameter in all versions up to, and including, 1.15.48 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-95808 Form Maker by 10Web <= 1.15.48 - Unauthenticated SQL Injection via 'inputs' Parameter

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via the 'inputs' parameter in all versions up to, and including, 1.15.48 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-78193 JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated SQL Injection

The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via 'product.push' Identity Endpoint in all versions up to, and including, 2.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...

CVE-2026-78193

The JTL-Connector for WooCommerce plugin for WordPress, versions up to and including 2.4.3 , is vulnerable to a time-based SQL Injection . The root cause is insufficient escaping of user-supplied parameters and a lack of proper preparation on existing SQL queries within the 'product.push' Identit...

EUVD-2026-100793

The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via 'product.push' Identity Endpoint in all versions up to, and including, 2.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...

CVE-2026-96661

The Gmedia Photo Gallery plugin for WordPress is vulnerable to time-based SQL Injection in all versions up to and including 1.25.1 . The root cause is insufficient escaping of the 'gmedia__in' parameter and a lack of proper preparation on existing SQL queries. This vulnerability allows unauthenti...

CVE-2026-96661 Gmedia Photo Gallery <= 1.25.1 - Unauthenticated SQL Injection via 'gmedia__in' Parameter

The Gmedia Photo Gallery plugin for WordPress is vulnerable to time-based SQL Injection via the 'gmediain' parameter in all versions up to, and including, 1.25.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2026-104800

The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution (RCE) in all versions up to and including 1.0 . The flaw exists in the standalone admin.php endpoint, which lacks authentication, capability checks, and nonce verification. Specifically, the plugin fails to sanitize POST par...