PT-2026-97513

Name of the Vulnerable Software and Affected Versions Easy Store versions 1.0.0 through 3.0.0 Description Two distinct issues exist in the extension. First, the endpoint 'administrator/index.php?option=com easystore&task=media.deleteImage' fails to properly sanitize the ids parameter, which is...

EUVD-2025-210998

SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP requests...

PT-2026-97316

Name of the Vulnerable Software and Affected Versions ManageEngine Applications Manager versions 182000 and earlier Description A low-privileged user can execute unauthorized SQL commands, which may lead to the attainment of administrator privileges and remote code execution RCE, a process where ...

CVE-2026-90901: Improper Neutralization of Special Elements used in an SQL Command

Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0 - The media deletion endpoint administrator/index.php?option=comeasystore&task=media.deleteImage parsed the ids parameter as a comma-separated string and implode...

PT-2026-97123

Name of the Vulnerable Software and Affected Versions ClipBucket versions 5.x through 5.5.3-182 Description An issue exists in the photo search endpoint search result.php where the query parameter is passed unsanitized into SQL WHERE and ORDER BY clauses. This allows unauthenticated attackers to...

PT-2026-97624

Name of the Vulnerable Software and Affected Versions pmTicket Project-Management-Software versions up to 078fa56a782490c5059a0814f84df27984f4d7e2 Description A remote SQL injection is possible due to improper handling of the conn settings argument within the setSync function of the '/ajax/add...

PT-2026-97514

Name of the Vulnerable Software and Affected Versions Easy Store versions 1.0.0 through 3.0.0 Description An authenticated administrator can perform a SQL Injection through the coupon bulk update task. The issue occurs because the application takes input IDs and directly concatenates them into ra...

PT-2026-97121

Name of the Vulnerable Software and Affected Versions SourceCodester Online Reviewer Management System version 1.0 Description Remote SQL injection is possible through the manipulation of the difficulty id variable within an unknown function of the '/reviewer 0/admins/assessments/databank/btn...

PT-2026-97241

Name of the Vulnerable Software and Affected Versions Rename wp-login.php to anything you want versions prior to 2.0.2 Description The plugin is subject to time-based SQL Injection, a technique where an attacker sends a query that forces the database to wait a specific amount of time before...

PT-2026-97607

Name of the Vulnerable Software and Affected Versions Abdurrab5 online-makeup-store affected versions not specified Description An issue exists in the Customer Login Handler component within the customerSignin.php file. Remote manipulation of the username and password arguments allows for SQL...

CVE-2026-86677: Improper Neutralization of Special Elements used in an SQL Command

ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to run unauthorized SQL commands, potentially gaining administrator access and remote code execution...

PT-2026-97476

Name of the Vulnerable Software and Affected Versions Easy Digital Downloads versions prior to 3.7.1 Description An SQL Injection issue exists in the Shop manager component. This allows an attacker to interfere with the queries that an application makes to its database, potentially allowing them ...

PT-2026-97459

Administrator SQL Injection in Email Log = 2.63 versions...

PT-2026-97387

Name of the Vulnerable Software and Affected Versions Moodle Socialwall plugin versions 3.0 through 3.3 Description A SQL injection flaw allows an attacker to execute arbitrary code by sending specially crafted HTTP requests. SQL injection is a technique where malicious SQL statements are inserte...

CVE-2025-63564

SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP requests...

PT-2026-97445

Contributor SQL Injection in Live Copy Paste for Elementor = 1.5.10 versions...

CVE-2026-95927: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in SourceCodester Online Reviewer Management System 1.0. This affects an unknown function of the file /reviewer0/admins/assessments/pretest/exam-delete.php. Such manipulation of the argument testid leads to sql injection. The attack may be performed from remote. The...

CVE-2025-63564

SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP requests...

CVE-2026-95601: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Product Filter by WBW = 3.1.7 versions...

Fedora 44 : postgresql16-anonymizer (2026-58a319c686)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-58a319c686 advisory. Upstream changelog: https://gitlab.com/dalibo/postgresqlanonymizer/-/releases - core CVE-2026-19633: Escalation via custom types, operators and...