29433 matches found
CVE-2026-65694
Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to read arbitrary files by supplying directory traversal sequences in the path query parameter. Attackers can send a single unauthenticated HTTP GET...
CVE-2026-16765
A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue is some unknown functionality of the file /OnlineClassroom/loginlinkadmin.php. Executing a manipulation of the argument aid can lead to sql injection. The attack can be executed remotely. The exploit has been...
CVE-2026-16765 CodeAstro Online Classroom loginlinkadmin.php sql injection
A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue is some unknown functionality of the file /OnlineClassroom/loginlinkadmin.php. Executing a manipulation of the argument aid can lead to sql injection. The attack can be executed remotely. The exploit has been...
CVE-2026-65694
Microweber CMS up to version 2.0.20 is affected by a path traversal in the static file controller. The vulnerability allows unauthenticated remote attackers to read arbitrary files by supplying directory traversal sequences in the path query parameter, exploiting normalize_path() failure to strip...
[SECURITY] [DSA 6399-1] wordpress security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6399-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 23, 2026 https://www.debian.org/security/faq -...
DHIS2 SQL Injection in SqlView Filter Parameter Leading to Arbitrary Database Read
RISK EVALUATION A SQL injection vulnerability was identified in the SqlView API endpoint of the DHIS2 application in the filter parameter used by the /api/sqlViews/viewId/data.json endpoint. An authenticated user with access to a SqlView can inject arbitrary SQL queries inside the filter...
CVE-2026-65761
Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 - Improper validation of order parameters lead to an unauthenticated SQL injection in easystore, allowing full DB read access including credentials and sessions...
K000162387: PostgreSQL vulnerability CVE-2026-6476
Security Advisory Description SQL injection in PostgreSQL pgcreatesubscriber allows an attacker with pgcreatesubscription rights to execute arbitrary SQL as a superuser. The attack takes effect when pgcreatesubscriber next runs. Within major versions 17 and 18, minor versions before PostgreSQL 18...
CVE-2026-65491
Subscriber Broken Access Control in Query Wrangler = 1.5.57 versions...
CVE-2026-65462
Administrator SQL Injection in Uncanny Automator = 7.3.2 versions...
WordPress Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce plugin <= 2.10.22 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce versions = 2.10.22...
EUVD-2026-48127
Contributor SQL Injection in Visualizer = 4.0.6 versions...
EUVD-2026-48102
Subscriber Broken Access Control in Query Wrangler = 1.5.57 versions...
CVE-2026-65491 WordPress Query Wrangler plugin <= 1.5.57 - Broken Access Control vulnerability
Subscriber Broken Access Control in Query Wrangler = 1.5.57 versions...
CVE-2026-65491
Technical details for CVE-2026-65491 are not publicly available in the provided documents; monitor for updates.
CVE-2026-65491 WordPress Query Wrangler plugin <= 1.5.57 - Broken Access Control vulnerability
Subscriber Broken Access Control in Query Wrangler = 1.5.57 versions...
CVE-2026-65491
Subscriber Broken Access Control in Query Wrangler = 1.5.57 versions...
CVE-2026-65451
CVE-2026-65451 concerns the WordPress MapSVG plugin, affecting versions <= 8.14.0, with a SQL Injection vulnerability. The connected records specify that this is a contributor SQL injection in MapSVG
CVE-2026-65450
MapSVG WordPress plugin versions <= 8.14.0 contain a SQL Injection vulnerability in contributor handling. CVSS 3.1 base score 8.5 (HIGH); attack vector NETWORK, complexity LOW, privileges REQUIRED LOW, no user interaction. Affected: WordPress MapSVG plugin (