1251 matches found
CVE-2026-78691
Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ashsql allows a user who supplies a search term to contains/2, stringstartswith/2, or stringendswith/2 to inject live SQL LIKE wildcards, turning a literal substring search into an attacker-controlled...
EUVD-2026-64668
A vulnerability was determined in code-projects Barangay Resident Profiling Management System 1.0. Affected is an unknown function of the file residents.php of the component Resident Search Functionality. This manipulation of the argument Search causes sql injection. Remote exploitation of the...
CVE-2026-78143
A vulnerability was determined in code-projects Barangay Resident Profiling Management System 1.0. Affected is an unknown function of the file residents.php of the component Resident Search Functionality. This manipulation of the argument Search causes sql injection. Remote exploitation of the...
CVE-2026-78143
A SQL injection vulnerability exists in the Barangay Resident Profiling Management System 1.0 (code-projects), specifically in the Resident Search Functionality within the file residents.php. The unsanitized Search argument allows a remote, unauthenticated attacker to inject SQL commands. The exp...
CVE-2026-78143 code-projects Barangay Resident Profiling Management System Resident Search Functionality residents.php sql injection
A vulnerability was determined in code-projects Barangay Resident Profiling Management System 1.0. Affected is an unknown function of the file residents.php of the component Resident Search Functionality. This manipulation of the argument Search causes sql injection. Remote exploitation of the...
PT-2026-79785
Name of the Vulnerable Software and Affected Versions code-projects Barangay Resident Profiling Management System version 1.0 Description An issue exists in the Resident Search Functionality within the residents.php file. Manipulation of the Search argument allows for remote SQL injection, a...
CVE-2026-16959
The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlers, allowing users with the Author role to perform SQL injection...
EUVD-2026-63820
The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlers, allowing users with the Author role to perform SQL injection...
Winter: Reflected XSS through the search query parameter in the backend Table widget
Impact Affected versions of Winter CMS render the search query parameter without HTML encoding inside a block in the backend Table widget partial modules/backend/widgets/table/partials/table.php: php value="" is an HTML raw-text context, so the surrounding value="…" attribute quoting is not a...
CVE-2026-76569
Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4...
EUVD-2026-63211
Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4...
CVE-2026-76569 Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4
Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4...
CVE-2026-76569 Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4
Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4...
PT-2026-78903
Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4...
EUVD-2026-57101
The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when a non-default search field type is configured...
CVE-2026-18473 WP Directory Kit < 1.5.5 - Unauthenticated SQL Injection via 'field_search' Parameter
The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...
CVE-2026-71246
Pixelfed's SearchController behind the auth middleware accepts a URL via its remote-search parameters and fetches it server-side through ActivityPubFetchService, whose validateUrl only blocks the literal hosts 127.0.0.1, localhost, and ::1 and requires https, without checking the resolved IP...
CVE-2026-17505
The CVE covers TranslatePress
CVE-2026-5062
The PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin plugin for WordPress is vulnerable to SQL Injection via the 's' search parameter on the Pretty Links listing page in all versions up to, and including, 3.6.20. This is due to insufficient escapin...
EUVD-2026-53034
The PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin plugin for WordPress is vulnerable to SQL Injection via the 's' search parameter on the Pretty Links listing page in all versions up to, and including, 3.6.20. This is due to insufficient escapin...