284212 matches found
CVE-2026-104023
The Smart Popup by Supsystic plugin for WordPress is vulnerable to generic SQL Injection via the 'sidx' parameter in all versions up to, and including, 1.13.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...
EUVD-2026-96131
The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...
CVE-2026-87781 LTL Freight Quotes – Old Dominion Edition 4.2.11 - 4.2.18 - Unauthenticated SQLi via Shipping Rule 'edit_id' Parameter
The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...
CVE-2026-87781
The LTL Freight Quotes – Old Dominion Edition WordPress plugin is vulnerable to SQL injection in versions prior to 4.2.19 . The root cause is the failure to properly sanitize and escape the Shipping Rule 'edit_id' parameter before including it in a SQL statement. This flaw allows unauthenticated ...
EUVD-2026-96119
The Rank Math SEO WordPress plugin before 1.0.280 does not properly sanitise and escape a parameter before using it in a SQL query, allowing high-privilege users such as administrators to perform SQL injection attacks...
CVE-2026-104753
The Rank Math SEO WordPress plugin, in versions prior to 1.0.280 , is vulnerable to SQL injection due to insufficient sanitization and escaping of the 'per_page' parameter before it is used in a SQL query. This vulnerability allows users with high privileges, such as administrators , to perform u...
CVE-2026-104753 Rank Math SEO < 1.0.280 - Admin+ SQLi via 'per_page' Parameter
The Rank Math SEO WordPress plugin before 1.0.280 does not properly sanitise and escape a parameter before using it in a SQL query, allowing high-privilege users such as administrators to perform SQL injection attacks...
EUVD-2026-96087
The Smart Popup by Supsystic plugin for WordPress is vulnerable to generic SQL Injection via the 'sidx' parameter in all versions up to, and including, 1.13.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...
CVE-2026-104023
The Smart Popup by Supsystic plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.13.2 . The flaw exists in the 'sidx' parameter due to insufficient escaping of user-supplied input and a lack of proper SQL query preparation. This allows authenticated attackers...
CVE-2026-104023 Smart Popup by Supsystic <= 1.13.2 - Authenticated (Administrator+) SQL Injection via 'sidx' Parameter
The Smart Popup by Supsystic plugin for WordPress is vulnerable to generic SQL Injection via the 'sidx' parameter in all versions up to, and including, 1.13.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...
CVE-2026-104724
The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to generic SQL Injection via FireBox Form Display Condition in all versions up to, and including, 3.1.13 due to insufficient escaping on the user supplied parameter and la...
CVE-2026-104724
The FireBox – WooCommerce Popup Builder plugin for WordPress is vulnerable to a generic SQL Injection in all versions up to and including 3.1.13 . The root cause is insufficient escaping on user-supplied parameters and a lack of sufficient preparation on existing SQL queries within the FireBox Fo...
EUVD-2026-96066
The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to generic SQL Injection via FireBox Form Display Condition in all versions up to, and including, 3.1.13 due to insufficient escaping on the user supplied parameter and la...
CVE-2026-104724 FireBox <= 3.1.13 - Authenticated (Author+) SQL Injection via FireBox Form Display Condition
The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to generic SQL Injection via FireBox Form Display Condition in all versions up to, and including, 3.1.13 due to insufficient escaping on the user supplied parameter and la...
EUVD-2026-96025
In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions...
CVE-2026-108474
In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions...
CVE-2026-108474: Improper Neutralization of Special Elements used in an SQL Command
In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions...
CVE-2026-107712: Improper Neutralization of Special Elements used in an SQL Command
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the 'currentmonth' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
CVE-2026-87781: Improper Neutralization of Special Elements used in an SQL Command
The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...