WordPress SKT Addons for Elementor plugin <= 4.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin SKT Addons for Elementor versions = 4.0...

WordPress WP-Lister Lite for eBay plugin <= 3.8.11 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP-Lister Lite for eBay versions = 3.8.11...

WordPress MC Woocommerce Wishlist plugin <= 1.9.21 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin MC Woocommerce Wishlist versions = 1.9.21...

WordPress PublishPress Series plugin <= 3.1.3 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin PublishPress Series versions = 3.1.3...

CVE-2026-87963

The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthenticated attackers to perform SQL injection and read arbitrary database...

CVE-2026-87963 Yo 1.1 - 1.3.1 - Unauthenticated SQL Injection via username Parameter

The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthenticated attackers to perform SQL injection and read arbitrary database...

EUVD-2026-81385

The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthenticated attackers to perform SQL injection and read arbitrary database...

CVE-2026-87963 Yo 1.1 - 1.3.1 - Unauthenticated SQL Injection via username Parameter

The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthenticated attackers to perform SQL injection and read arbitrary database...

CVE-2026-87963

The Yo WordPress plugin (versions 1.1 through 1.3.1 ) is affected by an unauthenticated SQL injection vulnerability. The plugin does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its built-in request escaping. An ...

Exploit for CVE-2026-67401

CVE-2026-67401 — cPanel/WHM EmailTrack SQL Injection → Root RC...

PT-2026-94276

Name of the Vulnerable Software and Affected Versions PublishPress Series versions prior to 3.1.4 Description An SQL Injection issue exists that allows an administrator to execute malicious SQL queries. SQL Injection is a technique where an attacker inserts malicious SQL code into a query,...

PT-2026-94267

Contributor SQL Injection in Product Feed Manager = 7.12.0 versions...

PT-2026-94275

Shop manager SQL Injection in WP-Lister Lite for eBay = 3.8.11 versions...

PT-2026-95006

Name of the Vulnerable Software and Affected Versions SigNoz versions 0.88.0 through 0.142.0 Description Authenticated attackers can execute arbitrary SQL queries and retrieve results in HTTP responses. This occurs because the trace-funnel analytics endpoints interpolate the service name and span...

PT-2026-94226

Name of the Vulnerable Software and Affected Versions Snowflake CLI versions prior to 3.27.0 Description Improper input validation allows unsanitized user-controlled values to be interpolated into SQL strings executed as multi-statement queries. An attacker can execute arbitrary SQL statements...

CVE-2025-55787

In MailData Email Archiving System v4.2 and earlier, a SQL injection vulnerability exists...

CVE-2026-79752: Improper Neutralization of Special Elements used in an SQL Command

CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit valu...

CVE-2026-66631: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in MC Woocommerce Wishlist = 1.9.21 versions...

CVE-2026-66618: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in WP Maps = 4.9.9 versions...

PT-2026-95065

Name of the Vulnerable Software and Affected Versions Frappe HR versions prior to 16.7.0 Description An authenticated user with the HR User role can perform SQL injection through filters in the Salary Payments Based on Payment Mode report. The issue occurs in the salary payments based on payment...