PT-2026-109700

Name of the Vulnerable Software and Affected Versions Tickera tickera-event-ticketing-system versions prior to 3.6.0.6 Description An improper neutralization of special elements used in an SQL command allows for Blind SQL Injection. Blind SQL Injection is a technique where an attacker asks the...

CVE-2026-105889: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Tickera Tickera tickera-event-ticketing-system allows Blind SQL Injection.This issue affects Tickera: from n/a through 3.6.0.6...

CVE-2026-108474

JetBrains Exposed versions prior to 1.5.1 are vulnerable to an SQL injection flaw. The vulnerability stems from unescaped string arguments passed to several SQL functions. This flaw allows an attacker to potentially compromise the integrity, confidentiality, and availability of the database. Reme...

CVE-2026-108474

In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions...

hackazon

Hackazon Hackazon es un sitio de prueba vulnerable gratuito que es una tienda en línea construida con las mismas tecnologías utilizadas en las aplicaciones móviles y de cliente enriquecido actuales. Hackazon tiene una interfaz AJAX, flujos de trabajo estrictos y API RESTful utilizadas por una...

pymap

pymap — SQL injection discovery & exploitation toolkit Two co...

WordPress Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin <= 5.7.2 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by zickzick2 in WordPress Plugin LatePoint versions = 5.7.2...

WordPress WP Directory Kit plugin <= 1.5.9 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Tarcísio Luchesi De Almeida Silva Poystick in WordPress Plugin WP Directory Kit versions = 1.5.9...

WordPress WP Booking System – Booking Calendar plugin <= 2.1.0.1 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Spy0x7 in WordPress Plugin WP Booking System versions = 2.1.0.1...

CVE-2026-108096 Improper authorization in query resolvers for SQL-backed models in AWS Amplify API Category

Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might allow an authenticated remote user to read records owned by other users of the same application via crafted queries. This issue has been addressed in...

CVE-2026-108096 Improper authorization in query resolvers for SQL-backed models in AWS Amplify API Category

Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might allow an authenticated remote user to read records owned by other users of the same application via crafted queries. This issue has been addressed in...

WordPress Smart Popup by Supsystic plugin <= 1.13.2 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Popup by Supsystic versions = 1.13.2...

WordPress FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin <= 3.1.13 - Authenticated (Author+) SQL Injection vulnerability

Authenticated Author+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin FireBox versions = 3.1.13...

CVE-2026-108124

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in wp-post-author. This issue affects wp-post-author before 4.1.0...

CVE-2026-108125

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in wp-post-author. This issue affects wp-post-author version 4.0.0 prior to 4.1.0...

CVE-2026-108107

PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw queries. Attackers can send crafted username, macAddr or nasid parameters to the accounting or authenticate actions to...

CVE-2026-108100

HortusFox hortusfox-web before 6.2 contains an SQL injection vulnerability that allows API token holders to inject SQL by supplying crafted includeinfo values to the /api/locations/list endpoint. Attackers can place subqueries in includeinfo, which PlantsModel::getSpecificInfo concatenates into t...

EUVD-2026-95821

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in wp-post-author. This issue affects wp-post-author version 4.0.0 prior to 4.1.0...

CVE-2026-108125 WordPress Post Author Authenticated SQLi

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in wp-post-author. This issue affects wp-post-author version 4.0.0 prior to 4.1.0...

CVE-2026-108125

The wp-post-author plugin is vulnerable to an SQL injection flaw due to the improper neutralization of special elements used in an SQL command. This security issue specifically affects wp-post-author version 4.0.0 prior to 4.1.0 . Exploitation of this vulnerability may result in high confidential...