EUVD-2026-95507

The Code Snippets WordPress plugin before 3.10.0 does not sanitise and escape a user-supplied parameter before using it in a SQL query in some of its snippet-migration import endpoints, which are accessible to any user holding site-administration capabilities; on a WordPress Multisite network tho...

naxsi

Estado del Proyecto Esta es una actualización del estado del proyecto sobre Naxsi. Como habrán notado, el desarrollo de Naxsi se ha detenido y el repositorio será archivado por razones históricas. Esto significa que no se publicarán nuevas actualizaciones ni correcciones de errores para esta...

blind-sql-bitshifting

Inyección SQL Ciega mediante Desplazamiento de Bits Este es un módulo que realiza inyección SQL ciega utilizando el método de desplazamiento de bits para calcular caracteres en lugar de adivinarlos. Requiere 7/8 solicitudes por carácter, dependiendo de la configuración. Uso import...

EUVD-2026-95328

IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command...

EUVD-2026-95338

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute unauthorized SQL statements due to SQL injection...

EUVD-2026-95334

IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database...

EUVD-2025-211053

Jivejdon through 5.0 contains a sql injection vulnerability in AccountDaoSql.getAccountByNameLike that allows authenticated administrators to inject SQL via the username parameter. Attackers with the Admin role can submit crafted input to /admin/user/userListAction to read database contents,...

CVE-2026-96329: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in tagDiv tagDiv Opt-In Builder td-subscription allows Blind SQL Injection.This issue affects tagDiv Opt-In Builder: from n/a through 1.7.6...

CVE-2026-96330: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in tagDiv tagDiv Opt-In Builder td-subscription allows Blind SQL Injection.This issue affects tagDiv Opt-In Builder: from n/a through 1.7.6...

CVE-2026-108100: Improper Neutralization of Special Elements used in an SQL Command

HortusFox hortusfox-web before 6.2 contains an SQL injection vulnerability that allows API token holders to inject SQL by supplying crafted includeinfo values to the /api/locations/list endpoint. Attackers can place subqueries in includeinfo, which PlantsModel::getSpecificInfo concatenates into t...

PT-2026-108819

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through 3.2.9...

PT-2026-109330

Name of the Vulnerable Software and Affected Versions JetBrains Exposed versions prior to 1.5.1 Description SQL injection is possible because several SQL functions accept raw string arguments that are not escaped or parameterized. This allows crafted input to break out of the query context and...

Splunk Enterprise 10.4.0 < 10.4.3 (SVD-2026-1001)

The version of Splunk Enterprise installed on the remote host is 10.4.x prior to 10.4.3. Splunk Enterprise 10.2.x, 10.0.x, and 9.4.x are not affected. It is, therefore, affected by a SQL injection vulnerability as referenced in the SVD-2026-1001 advisory. A user that holds a role with the...

PT-2026-108849

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in jegtheme JNews - Pay Writer jnews-pay-writer allows Blind SQL Injection.This issue affects JNews - Pay Writer: from n/a through 12.0.1...

PT-2026-108865

Name of the Vulnerable Software and Affected Versions EduAdmin Booking versions prior to 6.0.0 Description An issue exists where improper neutralization of special elements used in an SQL command allows for Blind SQL Injection. Blind SQL Injection is a technique that allows an attacker to infer...

PT-2026-108873

Name of the Vulnerable Software and Affected Versions Testimonials by BestWebSoft WordPress plugin versions prior to 1.0.9 Description An issue exists where a parameter is not properly sanitized and escaped before being used in a SQL query. This allows unauthenticated attackers to perform SQL...

PT-2026-108844

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in VibeThemes WPLMS wplms allows Blind SQL Injection.This issue affects WPLMS : from n/a through 4.973...

PT-2026-108850

Name of the Vulnerable Software and Affected Versions tagDiv Opt-In Builder versions prior to 1.7.6 Description The td-subscription component contains an SQL Injection flaw, specifically allowing Blind SQL Injection. This occurs due to the improper neutralization of special elements used in an SQ...

PT-2026-108848

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in VibeThemes WPLMS wplms plugin allows Blind SQL Injection.This issue affects WPLMS: from n/a before 1.9.9.8.2...

CVE-2026-95599: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Taskbuilder Taskbuilder taskbuilder allows Blind SQL Injection.This issue affects Taskbuilder: from n/a through 6.0.5...