30173 matches found
CVE-2026-8307
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Webbeyaz Web Design Mediküm Web allows SQL Injection. This issue affects Mediküm Web: through 08072026. NOTE: The vendor was contacted and it was learned that the product is not supported...
EUVD-2026-42223
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Webbeyaz Web Design Mediküm Web allows SQL Injection. This issue affects Mediküm Web: through 08072026. NOTE: The vendor was contacted and it was learned that the product is not supported...
CVE-2026-12936 Recurio <= 1.1.3 - Authenticated (Shop Manager+) SQL Injection via 'data' Parameter
The Recurio – Ultimate Subscription for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'data' parameter in all versions up to, and including, 1.1.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
CVE-2026-9700 Eventer <= 4.4.2 - Unauthenticated SQL Injection via 'code' Parameter
The Eventer plugin for WordPress is vulnerable to time-based SQL Injection via the ‘code’ parameter in all versions up to, and including, 4.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...
EUVD-2026-42163
The Eventer plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, and including, 4.4.2. The plugin stores a plaintext copy of the password reset key in the eventerverificationcode user meta field when a user requests a password reset. The plaintext key...
IBM WebSphere eXtreme Scale code injection vulnerability
IBM WebSphere eXtreme Scale is an elastic data caching and object grid platform developed by American company IBM. IBM WebSphere eXtreme Scale has a code injection vulnerability. This vulnerability stems from the Object Query Language engine, which parses the names of classes provided by attacker...
PT-2026-56410
Name of the Vulnerable Software and Affected Versions Mediküm Web versions prior to 08072026 Description Mediküm Web contains an SQL injection flaw resulting from improper neutralization of special elements used in SQL commands. This occurs due to inadequate input validation or parameterization,...
PT-2026-56553
Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer Custom Reports modules. This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3...
Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2026-124 (ALASKERNEL-5.10-2026-124)
"The version of kernel installed on the remote host is prior to 5.10.259-258.1043. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2026-124 advisory. In the Linux kernel, the following vulnerability has been resolved: net/sched: teql: Fix double-free i...
CVE-2026-58656: Use of GET Request Method With Sensitive Query Strings
Grav API plugin before v1.0.0-rc.16 accepts JWT tokens via the ?token= URL query parameter and responds with Access-Control-Allow-Origin: , allowing unauthenticated attackers to make fully authenticated cross-origin API requests from any malicious website. Attackers who obtain a leaked JWT token...
CVE-2026-44840: Improper Neutralization of Special Elements in Data Query Logic
Dgraph is an open source distributed GraphQL database. Prior to version 25.3.4, the checkUserPassword GraphQL query in Dgraph is vulnerable to DQL Dgraph Query Language injection. User-supplied password values are interpolated directly into a DQL checkpwd query via fmt.Sprintf without any escapin...
PT-2026-56485
AFFiNE's histories GraphQL field fails to validate Doc.Read permission before exposing document edit history, allowing authenticated workspace members to retrieve restricted content timelines. Attackers can supply arbitrary document GUIDs to access full edit histories including user names, emails...
PT-2026-56654
A security flaw has been discovered in code-projects Online Food Order System 1.0. This affects an unknown part of the file /edit food items.php. The manipulation of the argument update results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the...
CVE-2026-39178
A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via the search parameter of the allContactSearch endpoint...
ROS-20260708-73-0032
The vulnerability of the sqlExpressions function on the Grafana monitoring and observation platform relates to the use of files and directories accessible from external parties. Exploiting this vulnerability could allow a malicious actor to read arbitrary files...
The vulnerability of the socket.io parser library’s encoder and decoder modules allows attackers to induce a service failure.
The vulnerability of the socket.io parser library’s encoder and decoder relates to the lack of security measures for SQL query structures. Exploiting this vulnerability allows an attacker to cause service failures remotely...
PT-2026-56402
The Tainacan plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'geoquery' parameter in all versions up to and including 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...
The vulnerability of the dual-way inverter series for KACO Blueplanet GridSave storage systems lies in the lack of protective measures for the SQL query structure, allowing attackers to enhance their privileges within the local network.
The vulnerability of the dual-way inverter series for KACO Blueplanet GridSave energy storage systems is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability can allow attackers to enhance their privileges within the local network...