29879 matches found
CVE-2026-12741 WP Fast Total Search <= 1.80.280 - Unauthenticated SQL Injection
The WP Fast Total Search – The Power of Indexed Search plugin for WordPress is vulnerable to generic SQL Injection via the 'formdatas' parameter in all versions up to, and including, 1.80.280 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
EUVD-2026-49690
The Chaty Pro plugin for WordPress is vulnerable to Authenticated Time-Based Blind SQL Injection in versions up to and including 3.5.5. This is due to the fetchcustomfield function in admin/class-admin-base.php retrieving the widgetid POST parameter via filterinputINPUTPOST, ... and directly...
EUVD-2026-49640
SQL injection vulnerability in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the sqlquery parameter of the syssqlquery.php component...
CVE-2026-51267
CVE-2026-51267 entry is rejected/not used; not a security issue.
PT-2026-65574
Tanium addressed a SQL injection vulnerability in Patch...
PT-2026-65596
IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to reuse another user's FAISS namespace to access owner-only vector content and influence later query results. This causes cross-user information disclosure and limited integrity impact through persistent poisoning of returned results...
PT-2026-65595
A SQL Injection in the Giving Reports functionality in Ellucian Advance Web and Legacy Advance allows an authenticated attacker to extract sensitive information from databases via a crafted SQL query in the class credit field. This issue affects Advance Web: all versions; Legacy Advance: all...
CVE-2026-47768: Use of GET Request Method With Sensitive Query Strings
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, newly-minted operator API key exposed in redirect URL Referer, history, proxy logs. This issue has been patched in version 0.3.2...
EUVD-2026-49865
schreibfaul1 ESP32-audioI2S 3.4.5 has a heap-based buffer overflow vulnerability in the URL path concatenation and encoding module. The application splices untrusted extension path and attacker-controlled query string into a path buffer, then invokes urlencode without validating the final string...
PT-2026-65428
The PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Injection in versions up to and including 1.2.73. This is due to insufficient sanitization of user-supplied input via the 'id' GET parameter in the user profile template combined with the use of wp unslash which removes...
ROS-20260728-73-0015
The vulnerability of the Maintenance Tool component in the pgAdmin 4 database management tool is related to the lack of security measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
PT-2026-65419
The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to SQL Injection via the 'wppm proj filter' parameter in versions up to, and including, 5.0.9. This is due to insufficient escaping on the user-supplied parameter and the lack of...
Rocky Linux Security Update for glibc (RLSA-2026:2786) and kernel (RLSA-2026:2722)
Brocade SANnav OVA has provided security updates for Multiple vulnerabilities ias referenced in glibc RLSA-2026:2786, kernel RLSA-2026:2722 glibc RLSA-2026:2786 glibc: Integer overflow in memalign leads to heap corruption CVE-2026-0861 glibc: glibc: Information disclosure via zero-valued network...
CVE-2026-17191 VeloCloud Orchestrator Flow Metrics API SQL Injection
An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend queries, which may result in unauthorized access to data beyond their intended privileges and cause the underlying system to initiate unintended...
CVE-2025-50455
SQL injection vulnerability exists in the orderby parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments = 1.5.1. The vulnerability arises from unsanitized user input passed to the orderby method of the CodeIgniter Query Builder, enabling attackers to perform time-based...
CVE-2026-59551
Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress = 4.7.10 versions...
CVE-2026-59549
Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress = 4.7.10 versions...
CVE-2026-65877
Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder 6.7.1 - Improper validation of various parameters in the media manager search and date filters lead to an SQL injection vector...