BIT-POSTGRESQL-2026-15741 PostgreSQL expression deparse allows SQL injection via EXTRACT argument

SQL injection in PostgreSQL EXTRACT deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pgdump, psql commands like \sf, and any similar usage in non-core tools. Versions before...

WordPress Total Donations plugin <= 2.0.5 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Total Donations versions = 2.0.5...

CVE-2024-40498

CVE-2024-40498 Aplicação Afetada online-shopping-system-advanced 1.0 https://github.com/PuneethReddyHC/online-shopping-system-advanced Descrição O arquivo register.php lida com o registro de usuários. Na linha 117, os parâmetros POST "$address1" e "$address2" não são sanitizados, ao contrário do...

SimpleCTF-UpdatedExploit

CMS Made Simple = 2.2.10 SQL-Injection-Exploit Überblick Dieses Python-Skript nutzt eine nicht authentifizierte SQL-Injection-Sicherheitslücke in CMS Made Simple = 2.2.10 CVE-2019-9053 aus. Der Exploit extrahiert vertrauliche Informationen wie Salt, Benutzernamen, E-Mail und Passwort des...

CVE-2022-28346

CVE-2022-28346 SQL-Injection in Django QuerySet.annotate, aggregate, extra Initialisierung der Umgebung root@kitploit: 1.python manage.py makemigrations 2.python manage.py migrate 3. Rufe http://x.x.x.x:8000/ auf und füge Initialisierungsdaten ein Reproduktion der Schwachstelle root@kitploit: Ruf...

WordPress Maps Marker Pro plugin <= 4.32 - SQL Injection vulnerability

SQL Injection vulnerability discovered by johska in WordPress Plugin Maps Marker Pro versions = 4.32...

CVE-2026-16950

The Product Shortlist WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks...

CVE-2026-12983

The Dinatur WordPress plugin through 1.18 does not sanitize and escape user input before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks. The same handler also performs a database table truncation without any authorization check, allowing any unauthenticat...

EUVD-2026-62273

The Product Shortlist WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks...

CVE-2026-16950

The Product Shortlist WordPress plugin (≤1.0.4) exposes an unauthenticated SQL injection flaw in the get_shortlisted_products function. A parameter is passed unsanitised into a SQL query, enabling remote attackers to extract database contents. CVSS 3.1 scores this HIGH (8.6, AV:N/AC:L/PR:N/UI:N)....

CVE-2026-16950 Product Shortlist <= 1.0.4 - Unauthenticated SQL Injection via get_shortlisted_products

The Product Shortlist WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks...

CVE-2026-12983 Dinatur <= 1.18 - Unauthenticated SQL Injection via Column Name Injection

The Dinatur WordPress plugin through 1.18 does not sanitize and escape user input before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks. The same handler also performs a database table truncation without any authorization check, allowing any unauthenticat...

CVE-2026-12983 Dinatur <= 1.18 - Unauthenticated SQL Injection via Column Name Injection

The Dinatur WordPress plugin through 1.18 does not sanitize and escape user input before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks. The same handler also performs a database table truncation without any authorization check, allowing any unauthenticat...

CVE-2026-12983

The Dinatur WordPress plugin (≤1.18) has an unauthenticated SQL injection via unsanitized column-name input in a SQL query, enabling data exfiltration (CVSS 8.6 HIGH). The same handler also truncates database tables without authorization, allowing any visitor to wipe plugin data. No patch version...

EUVD-2026-62257

The Dinatur WordPress plugin through 1.18 does not sanitize and escape user input before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks. The same handler also performs a database table truncation without any authorization check, allowing any unauthenticat...

CVE-2026-76050

A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This impacts an unknown function of the file /admin/ajax.php?action=deletemenu. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been made...

CVE-2026-76049

A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affects an unknown function of the file /admin/ajax.php?action=savemenu. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-76050 SourceCodester Simple Online Food Ordering System ajax.php delete_menu sql injection

A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This impacts an unknown function of the file /admin/ajax.php?action=deletemenu. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been made...

EUVD-2026-62228

A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This impacts an unknown function of the file /admin/ajax.php?action=deletemenu. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been made...

CVE-2026-76050

SQL injection exists in the ID argument of /admin/ajax.php?action=delete_menu in SourceCodester Simple Online Food Ordering System 1.0, exploitable remotely without authentication; a public proof-of-concept exists, so patching or replacing the vulnerable input handling is critical. No remediation...