PT-2026-110061

Name of the Vulnerable Software and Affected Versions Loja Automática versions prior to 1.0.1 Description Unauthenticated users can perform SQL injection attacks because the plugin fails to properly sanitize and escape the id parameter before incorporating it into a SQL query. SQL injection is a...

PT-2026-110055

Name of the Vulnerable Software and Affected Versions WpCues Basic Quiz versions prior to 1.6.6 Description The plugin fails to properly sanitize and escape values before incorporating them into a SQL statement. This allows unauthenticated attackers to execute SQL injection attacks, which is a...

PT-2026-110060

Name of the Vulnerable Software and Affected Versions ASPL Product Quotation versions prior to 1.1.1 Description An issue exists where the software fails to sanitize and escape the quote id parameter before incorporating it into SQL statements. This allows unauthenticated attackers to execute SQL...

PT-2026-110351

A flaw has been found in erzhongxmu JEEWMS up to 2026.09.27-W39. The affected element is the function getbinall/getbinallagv of the file src/main/java/com/zzjee/md/controller/MdBinController.java. Executing a manipulation of the argument binstore/binid/des/cengshu can lead to sql injection. The...

PT-2026-110025

Name of the Vulnerable Software and Affected Versions Tcard WP versions prior to 1.8.1 Description The plugin fails to sanitize and escape a parameter used in a SQL statement within an unauthenticated AJAX action. This allows unauthenticated users to execute SQL injection attacks, which involve...

PT-2026-110063

Name of the Vulnerable Software and Affected Versions Post Voting System versions prior to 1.1 Description An issue exists where the software fails to properly sanitize and escape the id parameter before incorporating it into a SQL query. This allows unauthenticated users to execute SQL injection...

PT-2026-110187

Name of the Vulnerable Software and Affected Versions erzhongxmu Jeewms versions prior to 3.7 Description A remote SQL injection issue exists within the Autocomplete Data Handler component. The flaw is located in the getTreeData function of the...

CVE-2026-59508: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Interuse i-Bos. This issue affects i-Bos: 3.0...

CVE-2026-108684: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in erzhongxmu Jeewms up to 3.7. This affects the function getTreeData of the file src/main/java/com/jeecg/demo/controller/JeecgFormDemoController.java of the component Autocomplete Data Handler. Performing a manipulation of the argument searchVal results in sql...

CVE-2026-108571: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6. This impacts the function kqjcmdModel::returnchuli of the file webmain/task/openapi/openkqjAction.php of the component Openkqj Action. This manipulation of the argument ID causes sql injection. The attack is possible to be carri...

CVE-2026-108569: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in Furion .NET Framework up to 4.9.9.92. The impacted element is the function String.Replace of the file framework/Furion/Templates/Extensions/StringRenderExtensions.cs. The manipulation of the argument Name leads to sql injection. Remote exploitation of the attack ...

CVE-2026-89305: Improper Neutralization of Special Elements used in an SQL Command

The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to perform SQL injection attacks...

CVE-2026-89302: Improper Neutralization of Special Elements used in an SQL Command

The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-89299: Improper Neutralization of Special Elements used in an SQL Command

The WP Verify API WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-89297: Improper Neutralization of Special Elements used in an SQL Command

The Loja Automática WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-89287: Improper Neutralization of Special Elements used in an SQL Command

The ASPL Product Quotation WordPress plugin through 1.1.0 does not sanitize and escape a parameter before using it in SQL statements, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database...

CVE-2026-89285: Improper Neutralization of Special Elements used in an SQL Command

The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several request parameters before using them to build a SQL query, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database...

CVE-2026-89234: Improper Neutralization of Special Elements used in an SQL Command

The WP-Partner WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database...

CVE-2026-89214: Improper Neutralization of Special Elements used in an SQL Command

The WpCues Basic Quiz WordPress plugin through 1.6.5 does not properly sanitise and escape values before using them in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database...

CVE-2026-89213: Improper Neutralization of Special Elements used in an SQL Command

The Llavero.io WordPress plugin through 0.1.4 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database...