CVE-2026-66625: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in WC Vendors Marketplace = 2.7.2.1 versions...

CVE-2025-55787

In MailData Email Archiving System v4.2 and earlier, a SQL injection vulnerability exists...

PT-2026-94274

Editor SQL Injection in SKT Addons for Elementor = 4.0 versions...

PT-2026-94185

Name of the Vulnerable Software and Affected Versions Yo WordPress plugin versions 1.1 through 1.3.1 Description An issue exists where the software fails to sanitize or parameterize the username request parameter before incorporating it into a SQL query. Because the parameter is read before...

EmailTrack Component Code Execution

The vulnerability of the EmailTrack component in the cPanel web hosting control panel is related to the lack of security measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code and gain full control over the server...

CVE-2026-87963: Improper Neutralization of Special Elements used in an SQL Command

The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthenticated attackers to perform SQL injection and read arbitrary database...

PT-2026-95138

Name of the Vulnerable Software and Affected Versions SQLBot versions prior to 1.9.0 Description An issue exists where the POST /api/v1/datasource/previewData endpoint incorporates the client-controlled table name value into generated SQL without safe identifier handling. An authenticated user ca...

CVE-2026-66630: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in PublishPress Series = 3.1.3 versions...

CVE-2026-93426: Improper Neutralization of Special Elements used in an SQL Command

SigNoz versions 0.87.0 before 0.142.0 fail to escape user-supplied telemetry field-key names in the v5 queryrange API, allowing authenticated users to inject SQL. Attackers with Viewer role or higher can embed backticks and quotes in field names to break out of identifiers and string literals,...

CVE-2026-53556: Improper Neutralization of Special Elements used in an SQL Command

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/previewData endpoint in backend/apps/datasource/crud/datasource.py incorporates the client-controlled tablename value into generated SQL without safe identifier handling...

PT-2026-95101

Name of the Vulnerable Software and Affected Versions MapServer versions prior to 8.6.4 Description MapServer's PostGIS runtime filter translation in src/mappostgis.cpp and the msPostGISLayerTranslateFilter function fails to verify that input from the CGI qstring or OGC API Features featureId is ...

CVE-2026-54647: Improper Neutralization of Special Elements used in an SQL Command

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/settings.index.inc.php directly concatenates the administrator-controlled downloadexpire POST parameter into a raw UPDATE statement for CubeCartdownloads without numeric validation. An authenticated administrator can supply...

PT-2026-95155

Name of the Vulnerable Software and Affected Versions CubeCart versions prior to 6.7.5 Description An issue exists in the ecommerce software where the endpoint 'admin/sources/settings.index.inc.php' directly concatenates the download expire POST parameter into a raw UPDATE statement for CubeCart...

PT-2026-95154

Name of the Vulnerable Software and Affected Versions CubeCart versions prior to 6.7.5 Description An issue exists in the admin/sources/maintenance.index.inc.php endpoint where administrator-controlled tablename values are inserted into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE statements witho...

CVE-2026-92926: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in code-projects Matrimonial System 1.0. This vulnerability affects the function writepartnerprefs of the file /partnerpreference.php. Such manipulation of the argument education leads to sql injection. The attack can be executed remotely. The exploit has been...

CVE-2025-55787: Improper Neutralization of Special Elements used in an SQL Command

In MailData Email Archiving System v4.2 and earlier, a SQL injection vulnerability exists...

PT-2026-95082

In MailData Email Archiving System v4.2 and earlier, a SQL injection vulnerability exists...

CVE-2026-66624: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in WPMasterToolKit = 2.22.0 versions...

CVE-2026-66619: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in Newsletters = 4.18 versions...

CVE-2026-54646: Improper Neutralization of Special Elements used in an SQL Command

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablename values into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE statements without validating the identifiers or escaping embedded backticks. An authenticated...