CVE-2026-102578 Moodle: sql injection in question bank web service

A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL Structured Query Language injection vulnerability. This issue could allow an attacker to view, alter, or delete...

WordPress Easy Pricing Tables plugin <= 4.1.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Easy Pricing Tables versions = 4.1.2...

CVE-2026-102456 DigiWin｜EasyFlow .NET - SQL Injection

EasyFlow .NET developed by Digiwin has an SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read database contents...

CVE-2026-102456 DigiWin｜EasyFlow .NET - SQL Injection

EasyFlow .NET developed by Digiwin has an SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read database contents...

EUVD-2026-89712

EasyFlow .NET developed by Digiwin has an SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read database contents...

CVE-2026-102456

The EasyFlow .NET application, developed by Digiwin , contains an SQL Injection vulnerability. This flaw allows authenticated remote attackers to inject arbitrary SQL commands, which can be used to read database contents . No specific remediation or exploit details are provided in the documents.

CVE-2026-6806

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'stmlat/stmlng' parameter in all versions up to, and including, 1.4.109 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-16596

The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'datafieldslist' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2026-16596 WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'data_fields_list' Parameter

The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'datafieldslist' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2026-16596 WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'data_fields_list' Parameter

The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'datafieldslist' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

EUVD-2026-89671

The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'datafieldslist' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2026-16596

The WP Directory Kit plugin for WordPress is vulnerable to a generic SQL Injection in all versions up to and including 1.5.4 . The root cause is insufficient escaping of the user-supplied data_fields_list parameter combined with a lack of sufficient preparation on the existing SQL query. This vul...

CVE-2026-6806 Motors <= 1.4.109 - Unauthenticated Blind SQL Injection via 'stm_lat'/'stm_lng' Parameters

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'stmlat/stmlng' parameter in all versions up to, and including, 1.4.109 due to insufficient escaping on the user supplied parameter and lack of sufficient...

EUVD-2026-89669

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'stmlat/stmlng' parameter in all versions up to, and including, 1.4.109 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-6806

The Motors – Car Dealership & Classified Listings Plugin for WordPress is vulnerable to a time-based blind SQL Injection in all versions up to and including 1.4.109 . The flaw exists in the 'stm_lat' and 'stm_lng' parameters due to insufficient escaping of user-supplied input and a lack of proper...

CVE-2026-6806 Motors <= 1.4.109 - Unauthenticated Blind SQL Injection via 'stm_lat'/'stm_lng' Parameters

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'stmlat/stmlng' parameter in all versions up to, and including, 1.4.109 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-102578

A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL Structured Query Language injection vulnerability. This issue could allow an attacker to view, alter, or delete...

CVE-2026-102913

A security flaw has been discovered in SourceCodester Car Driving School Management System 1.0. Impacted is an unknown function of the file /classes/Master.php?f=saveenrollment. The manipulation results in sql injection. The attack can be executed remotely. The exploit has been released to the...

CVE-2026-102912

A vulnerability was identified in SourceCodester Online Leave Management System 1.0. This issue affects some unknown processing of the file /admin/?page=reports. The manipulation of the argument datestart/dateend leads to sql injection. Remote exploitation of the attack is possible. The exploit i...

CVE-2026-102910

A security flaw has been discovered in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /reviewer0/admins/assessments/examproper/exam-delete.php. The manipulation of the argument testid results in sql injection. The attack can be launch...