EUVD-2026-48192

Unauthenticated SQL Injection in MapSVG = 8.14.0 versions...

EUVD-2026-48147

Contributor SQL Injection in eRoom = 1.7.1 versions...

WordPress Relevanssi Light plugin <= 1.2.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by ParkHyunWoo in WordPress Plugin Relevanssi Light versions = 1.2.2...

CVE-2026-64873

Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custom query URLs could access internal or reserved network services...

CVE-2026-64873 Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension

Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custom query URLs could access internal or reserved network services...

CVE-2026-64873

CVE-2026-64873 affects the Joomla Extension Cache Cleaner Pro from Regular Labs. The issue is described as an SSRF vulnerability where custom query URLs could reach internal or reserved network services, implying a high-severity impact (CVSS: 3.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; base score 9...

CVE-2026-64873 Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension

Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custom query URLs could access internal or reserved network services...

CVE-2026-64873

Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custom query URLs could access internal or reserved network services...

EUVD-2026-47897

Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custom query URLs could access internal or reserved network services...

CVE-2026-65755

Summary: CVE-2026-65755 concerns the Joomla extension family from regularlabs.com (Articles Anywhere and Users Anywhere). The issue is a date-sensitive query-cache leakage caused by cache keys that do not retain a bounded time component, allowing cached results to remain active across future publ...

EUVD-2026-47894

Joomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Users Anywhere extension - Date-sensitive query cache keys did not retain a bounded time component. Cached results could remain active across future publication or expiry boundaries, potentially...

CVE-2026-15761

The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tceventfilter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

EUVD-2026-47925

The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tceventfilter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-9713

CVE-2026-9713 : The Lumise Product Designer for WooCommerce WordPress plugin (up to version 2.1.1) is vulnerable to SQL injection via the uploaded cart JSON file processed by the checkout AJAX action. The root cause is insufficient escaping of user-provided parameters in the find_resource() funct...

CVE-2026-9066

The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress...

PT-2026-63603

Custom query URLs could access internal or reserved network services...

PT-2026-64188

Name of the Vulnerable Software and Affected Versions Microweber CMS versions prior to 2.0.21 Description A path traversal issue exists in the static file controller. Unauthenticated remote attackers can read arbitrary files, including system files and environment configuration files containing...

GHSA-652Q-GVQ3-74QV n8n: Snowflake Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation

Impact The n8n Snowflake node's Execute Query operation interpolated expression values directly into the SQL string, making queries built with untrusted data susceptible to SQL injection. Exploitation requires that a workflow author has already embedded untrusted expression data directly in a raw...

GHSA-JQWR-VX3P-R266 n8n: PostgresTrigger Node SQL Injection Allows Authenticated Users to Execute Arbitrary SQL on Connected PostgreSQL Instances

Impact The Postgres Trigger node interpolated user-supplied identifier parameters channel, function, and trigger names into SQL statements without proper escaping, so an authenticated user could inject arbitrary SQL executed against the connected PostgreSQL database with the configured credential...

NPM: n8n: GraphQL Node Bypasses "Allowed HTTP Request Domains" Restriction

NPM: n8n: GraphQL Node Bypasses "Allowed HTTP Request Domains" Restriction vulnerability discovered by ? in WordPress Npm n8n versions 1.123.64...