8885 matches found
PT-2026-67113
The sm page duplicator WordPress plugin through 1.0.0 does not sanitise and escape a stored value before using it in a SQL statement when duplicating a page, allowing users with the Editor role and above to perform SQL Injection attacks...
PT-2026-67517
Name of the Vulnerable Software and Affected Versions Z-BlogPHP version 1.7.5 Description An authenticated attacker can execute arbitrary SQL commands through a SQL injection flaw in the CommentBat feature. The issue occurs via the id parameter. Recommendations At the moment, there is no...
CVE-2026-51775
SQL injection vulnerability in Fastadmin v.1.6.1.20250430 allows an attacker to exectue arbitrary code via the application/common/controller/Backend.php component...
RHEL 9 : perl-DBI (RHSA-2026:49612)
The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:49612 advisory. DBI is a database access Application Programming Interface API for the Perl Language. The DBI API Specification defines a set of functions,...
CVE-2026-51775
SQL injection vulnerability in Fastadmin v.1.6.1.20250430 allows an attacker to exectue arbitrary code via the application/common/controller/Backend.php component...
Exploit for SQL Injection in Sangoma Freepbx
No d...
CVE-2026-13596
The Participants Database WordPress plugin before 2.7.8.4 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks...
PT-2026-67123
The WPvivid Backup & Migration plugin for WordPress is vulnerable to SQL Injection via the export data parameter in versions up to, and including, 0.9.131. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The values...
CVE-2026-58048
Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context...
CVE-2026-58048
Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context...
CVE-2026-46593
The CVE-2026-46593 entry describes an authenticated SQL injection in the PHP Jabbers – PHP Poll Script. The vulnerability arises from improper neutralization of user input to the pjAdminPolls.controller.php endpoint, enabling an authenticated attacker to perform SQL Injection attacks. The issue i...
EUVD-2026-51526
A SQL injection vulnerability has been identified in the PHP Jabbers - PHP Poll Script. Improper neutralization of input provided by user to pjAdminPolls.controller.php endpoint allows an authenticated attacker to perform SQL Injection attacks. This issue was fixed in version 4.1...
EUVD-2025-210567
An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. Improper neutralization of input provided by an authenticated user into parameters responsible for sorting functions allows an attacker to perform SQL Injection attacks. This issue was fixed in the...
WordPress Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin <= 5.0.9 - Authenticated (Subscriber+) SQL Injection vulnerability
Authenticated Subscriber+ SQL Injection vulnerability discovered by NOn Nss in WordPress Plugin Taskbuilder versions = 5.0.9...
CVE-2026-63221
CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch substitutes bound values from where conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the...
EUVD-2026-51428
The WP Go Maps WordPress plugin before 10.1.04 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...
PT-2026-66785
Name of the Vulnerable Software and Affected Versions cPanel affected versions not specified Description Improper preservation of SQL mode when renaming databases allows the execution of SQL commands in root context. Recommendations At the moment, there is no information about a newer version tha...
PT-2026-66750
A SQL injection vulnerability has been identified in the PHP Jabbers - PHP Poll Script. Improper neutralization of input provided by user to pjAdminPolls.controller.php endpoint allows an authenticated attacker to perform SQL Injection attacks. This issue was fixed in version 4.1...
PT-2026-66717
The WP Go Maps WordPress plugin before 10.1.04 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...