CVE-2026-5490

DriveLock SQL Injection Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of DriveLock. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP por...

CVE-2026-51992

SQL Injection vulnerability in ClickHouse Server Versions = 26.3.9.8 allows a remote attacker to execute arbitrary code via the create dictionaries function...

CVE-2026-8339

The CVE-2026-8339 issue affects Coverity Connect SOAP API, with SQL injection identified in versions 2024.6.0 through 2026.3.0 (inclusive). An authenticated attacker can send a crafted payload to achieve full read access to database contents and perform other unauthorized commands. The vulnerabil...

WP2Shell WordPress Exploit Technical Analysis and Real Attack Data

On July 17th, 2026, the WordPress Security Team released updates to WordPress core addressing a critical vulnerability chain that can be leveraged by unauthenticated attackers to create an administrator account and then execute code through normal administrator capabilities, such as uploading a...

WordPress Improved Save Button plugin <= 1.2.1 - Authenticated (Author+) Second-Order SQL Injection vulnerability

Authenticated Author+ Second-Order SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Improved Save Button versions = 1.2.1...

CVE-2026-65890 Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox 2.20.2 - Multiple SQLi vectors allow unauthenticated actors to inject SQL in queries...

CVE-2026-65890 Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox 2.20.2 - Multiple SQLi vectors allow unauthenticated actors to inject SQL in queries...

EUVD-2026-50337

Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox 2.20.2 - Multiple SQLi vectors allow unauthenticated actors to inject SQL in queries...

CVE-2026-65890

Summary: CVE-2026-65890 affects Joomla Extension Gridbox by balbooa.com, with unauthenticated SQL injection in Gridbox versions earlier than 2.20.2. The vulnerability allows unauthenticated actors to inject SQL via multiple vectors in queries, as indicated by the description and CVSS metrics (CRI...

CVE-2026-33385

A Blind SQL injection vulnerability has been identified in Quick.CMS. Improper neutralization of input provided by a high-privileged user into multiple fields in administration panel allows for Blind SQL Injection attacks. The vendor states that this administration panel already allows for...

CVE-2026-33385 Blind SQL Injection in Quick.CMS

A Blind SQL injection vulnerability has been identified in Quick.CMS. Improper neutralization of input provided by a high-privileged user into multiple fields in administration panel allows for Blind SQL Injection attacks. The vendor states that this administration panel already allows for...

EUVD-2026-50310

A Blind SQL injection vulnerability has been identified in Quick.CMS. Improper neutralization of input provided by a high-privileged user into multiple fields in administration panel allows for Blind SQL Injection attacks. The vendor states that this administration panel already allows for...

CVE-2026-12895

SQL injection in Frappe's ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2. The application constructs SQL queries through direct string interpolation using str.format without employing parameterized queries, allowing the name docname of a Supplier record containing SQL metacharacters to be...

CVE-2026-12895

CVE-2026-12895 affects ERPNext 15.107.0 and Frappe 15.107.2. The flaw arises from constructing SQL queries via direct string interpolation (str.format()) instead of parameterized queries, allowing an authenticated user with low privileges to inject SQL through a Supplier record name (docname). Ex...

EUVD-2026-50294

SQL injection in Frappe's ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2. The application constructs SQL queries through direct string interpolation using str.format without employing parameterized queries, allowing the name docname of a Supplier record containing SQL metacharacters to be...

CVE-2026-11973

The WP-Lister Lite for eBay plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2026-11973

Technical details about CVE-2026-11973 are not publicly available in the provided documents. Monitor for updates as new information may be released by vendors or researchers.

EUVD-2026-50200

The WP-Lister Lite for eBay plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2026-63231

A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via the face-to-face runs update endpoint to read the entire application database and obtain valid JWT tokens for account takeover...

CVE-2026-63229

A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to use a time-based SQL oracle via the SSO OAuth endpoint to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable...