CVE-2026-109901 WordPress CP Multi View Event Calendar plugin <= 1.4.41 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Codepeople CP Multi View Event Calendar cp-multi-view-calendar allows SQL Injection.This issue affects CP Multi View Event Calendar : from n/a through 1.4.41...

WordPress CP Multi View Event Calendar plugin <= 1.4.41 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Peter Tang in WordPress Plugin CP Multi View Event Calendar versions = 1.4.41...

SonicWall NSM On-Prem Affected By Multiple Vulnerabilities

1 CVE-2026-96540 - SonicWall NSM On-Prem Improper Access Control VulnerabilityAn improper access control vulnerability has been identified in the SonicWall Network Security Manager NSM on-prem in export settings, potentially allowing a remote authenticated attacker to obtain sensitive information...

CVE-2026-89310

A SQL Command Injection vulnerability exists in JTL-WMS (CVE-2026-89310). The flaw occurs because a parameter from the request body is inserted into a T-SQL statement without proper escaping or parameterization. This allows a remote attacker to execute arbitrary SQL commands within the context of...

EUVD-2026-100874

A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary SQL statements in the context of the application's database account...

CVE-2026-89310 SQL Command Injection Vulnerability in JTL-WMS

A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary SQL statements in the context of the application's database account...

WordPress Green Popups plugin < 7.6.3 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Rafie Muhammad in WordPress Plugin Green Popups versions 7.6.3...

Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities.

Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-84074 DESCRIPTION: IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web...

WordPress Gravity Forms plugin < 3.1.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Gravity Forms versions 3.1.1...

Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities.

Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-21998 DESCRIPTION: Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8...

CVE-2026-89288 Fast Courier 5.0.0 - 5.2.3 - Unauthenticated SQLi via 'wp_order_id' Parameter

The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database...

CVE-2026-89288

The Fast Courier WordPress plugin (versions 5.0.0-5.2.3 ) is vulnerable to SQL injection because it fails to sanitize and escape a value used in a SQL query on an unauthenticated REST route . Specifically, the vulnerability is triggered via the 'wp_order_id' parameter. An unauthenticated attacker...

CVE-2026-88927

The rtMedia for WordPress, BuddyPress and bbPress plugin (versions before 4.7.14 ) is vulnerable to an Insecure Direct Object Reference (IDOR) . The software fails to verify if a user owns or has write permissions for a specific album before processing an upload. Consequently, users with subscrib...

EUVD-2026-100860

The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database...

CVE-2026-88927 rtMedia for WordPress, BuddyPress and bbPress < 4.7.14 - Subscriber+ Arbitrary Album Media Injection via IDOR

The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.14 does not verify that a user owns or may write to the album an upload is assigned to, allowing users with a subscriber-level account or above to place media into another user's private album and have it attributed to...

WordPress rtMedia for WordPress, BuddyPress and bbPress plugin < 4.7.14 - Subscriber+ Arbitrary Album Media Injection vulnerability

Subscriber+ Arbitrary Album Media Injection vulnerability discovered by Lawal Qasim in WordPress Plugin rtMedia for WordPress, BuddyPress and bbPress versions 4.7.14...

EUVD-2026-100850

The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is permitted to access a restricted gallery before accepting comment submissions for its images, while it does perform that check when displaying comments, allowing unauthenticated attackers to inject...

CVE-2026-108069

The Sunshine Photo Cart WordPress plugin (versions before 3.7.4 ) is vulnerable to unauthenticated content injection due to a lack of permission checks in the sunshine_modal_add_comment() function. While the plugin correctly validates access when displaying comments, it fails to verify if a visit...

CVE-2026-108069 Sunshine Photo Cart < 3.7.4 - Unauthenticated Content Injection via sunshine_modal_add_comment()

The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is permitted to access a restricted gallery before accepting comment submissions for its images, while it does perform that check when displaying comments, allowing unauthenticated attackers to inject...

WordPress Sunshine Photo Cart plugin < 3.7.4 - Unauthenticated Content Injection vulnerability

Unauthenticated Content Injection vulnerability discovered by Raphael P. Cigana in WordPress Plugin Sunshine Photo Cart versions 3.7.4...