PT-2026-110353

A vulnerability was found in erzhongxmu JEEWMS up to 2026.09.27-W39. This affects the function WvGiController.list of the file src/main/java/com/zzjee/wmapi/controller/WvGiController.java. The manipulation of the argument searchstr results in sql injection. The attack can be executed remotely. Th...

PT-2026-110055

Name of the Vulnerable Software and Affected Versions WpCues Basic Quiz versions prior to 1.6.6 Description The plugin fails to properly sanitize and escape values before incorporating them into a SQL statement. This allows unauthenticated attackers to execute SQL injection attacks, which is a...

PT-2026-110059

Name of the Vulnerable Software and Affected Versions Datalist it versions prior to 0.0.4 Description The Datalist it WordPress plugin fails to sanitize and escape several request parameters used in the construction of SQL queries. This allows unauthenticated attackers to execute SQL injection...

CVE-2026-108571: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6. This impacts the function kqjcmdModel::returnchuli of the file webmain/task/openapi/openkqjAction.php of the component Openkqj Action. This manipulation of the argument ID causes sql injection. The attack is possible to be carri...

CVE-2026-108690: Operator Precedence Logic Error

mall4j through 4.0 contains an information disclosure vulnerability that allows authenticated customers to read other shoppers' cart items due to an operator precedence error in the getShopCartExpiryItems SQL filter. Attackers with any storefront account can request GET /p/shopCart/expiryProdList...

CVE-2026-103695: Improper Neutralization of Special Elements used in an SQL Command

The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks...

PT-2026-110350

Name of the Vulnerable Software and Affected Versions erzhongxmu JEEWMS versions prior to 2026.09.27-W39 Description A remote SQL injection is possible through the manipulation of the goodscode argument within the docheck function of the...

PT-2026-110054

Name of the Vulnerable Software and Affected Versions Llavero.io versions prior to 0.1.5 Description An issue exists where the software fails to properly sanitize and escape the cill login parameter before incorporating it into a SQL statement. This allows unauthenticated attackers to execute SQL...

PT-2026-110010

Name of the Vulnerable Software and Affected Versions Mobile builder WordPress plugin versions prior to 1.4.3 Description Unauthenticated users can perform SQL injection attacks because the plugin fails to sanitize and escape a parameter before incorporating it into a SQL statement. SQL injection...

CVE-2026-108569: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in Furion .NET Framework up to 4.9.9.92. The impacted element is the function String.Replace of the file framework/Furion/Templates/Extensions/StringRenderExtensions.cs. The manipulation of the argument Name leads to sql injection. Remote exploitation of the attack ...

PT-2026-110065

Name of the Vulnerable Software and Affected Versions paymendo WordPress plugin versions prior to 1.2 Description The plugin fails to properly sanitize and escape the orderBy parameter before incorporating it into a SQL query. This flaw allows authenticated users to execute SQL injection attacks,...

CVE-2026-59508: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Interuse i-Bos. This issue affects i-Bos: 3.0...

PT-2026-110063

Name of the Vulnerable Software and Affected Versions Post Voting System versions prior to 1.1 Description An issue exists where the software fails to properly sanitize and escape the id parameter before incorporating it into a SQL query. This allows unauthenticated users to execute SQL injection...

PT-2026-110061

Name of the Vulnerable Software and Affected Versions Loja Automática versions prior to 1.0.1 Description Unauthenticated users can perform SQL injection attacks because the plugin fails to properly sanitize and escape the id parameter before incorporating it into a SQL query. SQL injection is a...

PT-2026-110057

Name of the Vulnerable Software and Affected Versions WP-Partner versions prior to 1.2.2 Description An issue exists where the software fails to sanitize and escape the id parameter before incorporating it into a SQL query. This allows unauthenticated attackers to perform SQL injection, enabling...

PT-2026-110352

A vulnerability has been found in erzhongxmu JEEWMS up to 2026.09.27-W39. The impacted element is the function WvNoticeController.list of the file com/zzjee/wmapi/controller/WvNoticeController.java of the component Search Endpoint. The manipulation of the argument searchstr leads to sql injection...

PT-2026-110351

A flaw has been found in erzhongxmu JEEWMS up to 2026.09.27-W39. The affected element is the function getbinall/getbinallagv of the file src/main/java/com/zzjee/md/controller/MdBinController.java. Executing a manipulation of the argument binstore/binid/des/cengshu can lead to sql injection. The...

PT-2026-110052

Name of the Vulnerable Software and Affected Versions Social Web Suite versions prior to 4.1.13 Description The Social Web Suite WordPress plugin fails to require a shared secret before accepting authorized requests. Additionally, it does not sanitize or escape a parameter used in an SQL statemen...

PT-2026-110071

Name of the Vulnerable Software and Affected Versions highwarden Super Store Finder versions prior to 3.9 Description An issue exists in the /products/superstorefinder/index.php file where manipulation of the lat/lng argument allows for SQL injection, a technique used to interfere with the querie...

PT-2026-110064

Name of the Vulnerable Software and Affected Versions paymendo WordPress plugin versions prior to 1.2 Description The plugin fails to properly sanitize and escape the paymendo bank transfer completed payment parameter before incorporating it into a SQL query. This flaw allows unauthenticated user...