283979 matches found
CVE-2026-89287: Improper Neutralization of Special Elements used in an SQL Command
The ASPL Product Quotation WordPress plugin through 1.1.0 does not sanitize and escape a parameter before using it in SQL statements, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database...
CVE-2026-89285: Improper Neutralization of Special Elements used in an SQL Command
The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several request parameters before using them to build a SQL query, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database...
CVE-2026-89234: Improper Neutralization of Special Elements used in an SQL Command
The WP-Partner WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database...
CVE-2026-89214: Improper Neutralization of Special Elements used in an SQL Command
The WpCues Basic Quiz WordPress plugin through 1.6.5 does not properly sanitise and escape values before using them in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database...
CVE-2026-89213: Improper Neutralization of Special Elements used in an SQL Command
The Llavero.io WordPress plugin through 0.1.4 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database...
CVE-2026-89195: Improper Neutralization of Special Elements used in an SQL Command
The Site Setup Wizard WordPress plugin through 1.5.8 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database...
CVE-2026-81420: Improper Neutralization of Special Elements used in an SQL Command
The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it in a SQL statement in one of its unauthenticated AJAX actions, allowing unauthenticated users to perform SQL injection attacks...
CVE-2026-103695: Improper Neutralization of Special Elements used in an SQL Command
The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks...
CVE-2026-108690: Operator Precedence Logic Error
mall4j through 4.0 contains an information disclosure vulnerability that allows authenticated customers to read other shoppers' cart items due to an operator precedence error in the getShopCartExpiryItems SQL filter. Attackers with any storefront account can request GET /p/shopCart/expiryProdList...
PT-2026-110059
Name of the Vulnerable Software and Affected Versions Datalist it versions prior to 0.0.4 Description The Datalist it WordPress plugin fails to sanitize and escape several request parameters used in the construction of SQL queries. This allows unauthenticated attackers to execute SQL injection...
CVE-2026-89304: Improper Neutralization of Special Elements used in an SQL Command
The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform blind SQL injection attacks...
PT-2026-110053
Name of the Vulnerable Software and Affected Versions Site Setup Wizard versions prior to 1.5.9 Description An issue exists where the plugin fails to properly sanitize and escape a parameter before incorporating it into a SQL statement. This allows unauthenticated attackers to execute SQL injecti...
PT-2026-110352
A vulnerability has been found in erzhongxmu JEEWMS up to 2026.09.27-W39. The impacted element is the function WvNoticeController.list of the file com/zzjee/wmapi/controller/WvNoticeController.java of the component Search Endpoint. The manipulation of the argument searchstr leads to sql injection...
PT-2026-110353
Name of the Vulnerable Software and Affected Versions erzhongxmu JEEWMS versions prior to 2026.09.27-W39 Description A remote SQL injection exists due to improper handling of the searchstr argument within the WvGiController.list function. SQL injection is a technique where an attacker inserts...
PT-2026-110056
Name of the Vulnerable Software and Affected Versions Recordbrowser WordPress plugin versions prior to 1.1.8 Description An issue exists where the software fails to sanitize and escape the recordid parameter before incorporating it into a SQL query. This allows unauthenticated attackers to perfor...
CVE-2026-108773: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was detected in erzhongxmu JEEWMS up to 2026.09.27-W39. Impacted is the function docheck of the file src/main/java/com/zzjee/wm/controller/WmOmNoticeHController.java. Performing a manipulation of the argument goodscode results in sql injection. The attack may be initiated remotely...
CVE-2026-57517-CWP
CVE-2026-57517 CWP Exploit This repository contains a Go-based proof-of-concept tool for testing a known Control Web Panel CWP vulnerability scenario related to CVE-2026-57517. The implementation targets a blind SQL injection path and includes optional webshell deployment and command execution fl...
CVE-2026-62117
Subscriber SQL Injection in Barcode Scanner with Inventory & Order Manager = 1.13.1 versions...