CVE-2026-96826: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Shazzad Hossain Khan W4 Post List allows Blind SQL Injection. This issue affects W4 Post List: from n/a through 3.0.6...

CVE-2026-95601: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Product Filter by WBW = 3.1.7 versions...

CVE-2026-95593: Improper Neutralization of Special Elements used in an SQL Command

Editor SQL Injection in Ultimeter = 3.0.8 versions...

CVE-2026-95590: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Tainacan = 1.2.0 versions...

CVE-2026-94174: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in Email Log = 2.63 versions...

CVE-2026-94124: Improper Neutralization of Special Elements used in an SQL Command

Contributor SQL Injection in WP EasyCart = 5.9.4 versions...

CVE-2026-93773: Improper Neutralization of Special Elements used in an SQL Command

Contributor SQL Injection in Mollie Forms = 2.11.0 versions...

CVE-2026-93527: Improper Neutralization of Special Elements used in an SQL Command

Contributor SQL Injection in Live Copy Paste for Elementor = 1.5.10 versions...

CVE-2026-92692: Improper Neutralization of Special Elements used in an SQL Command

Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affected Sulu 2.6 and 3.0 release lines have a Smart Content QueryBuilder in src/Sulu/Component/Content/SmartContent/QueryBuilder.php that concatenates category identifiers from the...

CVE-2026-90902: Improper Neutralization of Special Elements used in an SQL Command

Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0 - The coupon bulk update task administrator/index.php?option=comeasystore&task=coupon.couponBulkUpdate took input IDs and directly concatenated them into raw SQL I...

CVE-2026-90901: Improper Neutralization of Special Elements used in an SQL Command

Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0 - The media deletion endpoint administrator/index.php?option=comeasystore&task=media.deleteImage parsed the ids parameter as a comma-separated string and implode...

CVE-2026-96514: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in Neethuharii CafeManagement. Impacted is an unknown function of the file CafePortalLogin.php of the component Login Handler. This manipulation of the argument uname causes sql injection. It is possible to initiate the attack remotely. The exploit has been made...

CVE-2025-63564: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP requests...

CVE-2026-96673: Improper Neutralization of Special Elements used in an SQL Command

Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject SQL by manipulating the albumid path segment. Attackers can supply crafted SQL expressions in the albumid parameter to extract arbitrary data from the databa...

CVE-2026-96600: Improper Neutralization of Special Elements used in an SQL Command

Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled identifiers and administrator-supplied values directly into SQL statements. Authenticated Contao backend users with Isotope module permissions can exploit...

CVE-2026-86677: Improper Neutralization of Special Elements used in an SQL Command

ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to run unauthorized SQL commands, potentially gaining administrator access and remote code execution...

CVE-2026-93368: Improper Neutralization of Special Elements used in an SQL Command

The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' Username Parameter in all versions up to, and including, 2.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2022-4997: Improper Neutralization of Special Elements used in an SQL Command

The jet-form-builder-stripe-gateway WordPress plugin before 1.1.0 does not sanitise and escape a payment token before using it in a SQL statement, allowing unauthenticated users to extract arbitrary data from the database, including password hashes...

CVE-2026-95929: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in iFlytek astron-agent up to 1.0.7. Affected is an unknown function of the file console/backend/commons/src/main/resources/mapper/ChatBotMarketMapper.xml of the component getBotList API endpoint. Executing a manipulation of the argument sortDirection can lead to sq...

CVE-2026-95927: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in SourceCodester Online Reviewer Management System 1.0. This affects an unknown function of the file /reviewer0/admins/assessments/pretest/exam-delete.php. Such manipulation of the argument testid leads to sql injection. The attack may be performed from remote. The...