219047 matches found
CVE-2026-8443
CVE-2026-8443 affects the WordPress plugin WP Review Slider Pro (versions up to 12.6.8). The vulnerability is an SQL Injection in the wppro_get_overall_chart_data AJAX action, triggered via the stypes and slocations parameters. The root cause is the use of stripslashes() on user-supplied JSON pri...
CVE-2026-8443 WP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber+) SQL Injection via 'stypes' Parameter
The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'stypes' and 'slocations' parameters of the wpprogetoverallchartdata AJAX action in versions up to, and including, 12.6.8. This is due to the use of stripslashes on user-supplied JSON strings prior to jsondecode,...
EUVD-2026-37037
The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'stypes' and 'slocations' parameters of the wpprogetoverallchartdata AJAX action in versions up to, and including, 12.6.8. This is due to the use of stripslashes on user-supplied JSON strings prior to jsondecode,...
PT-2026-49619
The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'stypes' and 'slocations' parameters of the wppro get overall chart data AJAX action in versions up to, and including, 12.6.8. This is due to the use of stripslashes on user-supplied JSON strings prior to json...
PT-2026-50126
Unauthenticated SQL Injection in wpDataTables = 7.3.6 versions...
PT-2026-50125
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in wpWax Directorist Booking allows Blind SQL Injection. This issue affects Directorist Booking: from n/a through 3.0.3...
Exploit for CVE-2026-54596
CVE-2026-54596 - Authenticated SQL Injection via recurringinv...
EUVD-2026-36980
Unauthenticated SQL Injection in Contest Gallery = 28.1.6 versions...
EUVD-2026-36976
Subscriber SQL Injection in MasterStudy LMS = 3.7.25 versions...
EUVD-2026-36975
Unauthenticated SQL Injection in WPGraphQL 2.11.1 versions...
EUVD-2026-36947
Unauthenticated SQL Injection in Form Maker by 10Web = 1.15.38 versions...
EUVD-2026-36943
Unauthenticated SQL Injection in WP Maps = 4.9.1 versions...
EUVD-2026-36788
Bernd Bestel grocy v4.6.0 was discovered to contain a SQL injection vulnerability in the product-group parameter at /stockreports/spendings. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...
EUVD-2026-36762
Datadog, Inc Vector v0.54.0 was discovered to contain a SQL injection vulnerability in the seturiquery parameter in the KeyPartitioner::partition function. This vulnerability allows attackers to access sensitive database information via crafted SQL statements...
CVE-2026-52697
Subscriber SQL Injection in Taskbuilder = 5.0.7 versions...
CVE-2026-52700
Subscriber SQL Injection in WCMultiShipping = 3.0.2 versions...
CVE-2026-48886
Unauthenticated SQL Injection in JS Help Desk = 3.0.9 versions...
CVE-2026-45439
Unauthenticated SQL Injection in Realtyna Organic IDX plugin = 5.1.0 versions...