Kishan Lal Hospital Management System: Input validation error vulnerability

The Kishan Lal Hospital Management System has a security vulnerability. This vulnerability stems from the incorrect handling of the parameter ID in the mysqliquery function of the Appointment Cancellation Handler component, which may lead to SQL injection...

DevItems Support: Genix SQL Injection Vulnerability

DevItems Support Genix versions 1.4.54 and earlier have a SQL injection vulnerability. This vulnerability arises from improper neutralization of special elements in SQL commands, which may lead to SQL injections...

nemoTyrant manong input validation error vulnerability

nemoTyrant manong has a security vulnerability. This vulnerability stems from operational issues with the functions cache/delcache/arr2sql in the func.php file. It may lead to SQL injection attacks, and attackers could launch attacks remotely...

Ravi Teja Online-Examination-System Input Verification Error Vulnerability

Ravi Teja Online-Examination-System has a security vulnerability. This vulnerability stems from the improper handling of parameters in the exammanger.php file within the AJAX Endpoint component’s MySQLDB::topicslist function. It may lead to SQL injection attacks...

WordPress Booktics SQL Injection Vulnerability

WordPress Booktics versions 1.0.29 and earlier have a SQL injection vulnerability. This vulnerability arises due to improper handling of special elements in SQL commands, which may lead to SQL injections...

Ravi Teja Online-Examination-System Input Verification Vulnerability

Ravi Teja Online-Examination-System has a security vulnerability. This vulnerability stems from incorrect handling of parameters “id” and “topic” in the file results.php/include/database.php. It may lead to SQL injection attacks, and the attacks can be initiated remotely...

CLSA-2026-1792238249 dovecot: Fix of 5 CVEs

CVE-2026-40018: fail MySQL string escaping and SQL passdb lookups while not connected instead of escaping without the connection charset; SQL userdb lookups and dict-sql updates also fail temporarily while not connected...

Exploit for SQL Injection in Apache Log4J

CVE-2022-23305 Lab nghiên cứu, pin Apache Log4j 1.2.17 và JD...

portswigger-labs-writeups

PortSwigger Labs — Write-ups & Solutions Personal write-up re...

CVE-2026-104122

The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQL query, allowing users with Contributor-level access and above to perform SQL injection attacks...

CVE-2026-91074

The BSK PDF Manager WordPress plugin through 3.8.1 does not properly sanitise and escape a parameter before using it in a SQL statement, which could allow authenticated users with contributor-level access and above to perform SQL injection attacks and read sensitive data such as administrator...

CVE-2026-104122 Ukr-To-Lat <= 1.3.5 - Contributor+ SQLi via Term Name

The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQL query, allowing users with Contributor-level access and above to perform SQL injection attacks...

EUVD-2026-103254

The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQL query, allowing users with Contributor-level access and above to perform SQL injection attacks...

CVE-2026-104122 Ukr-To-Lat <= 1.3.5 - Contributor+ SQLi via Term Name

The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQL query, allowing users with Contributor-level access and above to perform SQL injection attacks...

CVE-2026-104122

The Ukr-To-Lat WordPress plugin, in versions through 1.3.5 , is vulnerable to SQL injection due to a failure to sanitize and escape a term name before utilizing it in a SQL query. This flaw allows users with Contributor-level access and above to execute unauthorized SQL commands. No specific reme...

EUVD-2026-103249

The BSK PDF Manager WordPress plugin through 3.8.1 does not properly sanitise and escape a parameter before using it in a SQL statement, which could allow authenticated users with contributor-level access and above to perform SQL injection attacks and read sensitive data such as administrator...

CVE-2026-91074 BSK PDF Manager <= 3.8.1 - Contributor+ SQLi via tags_specific Shortcode Attribute

The BSK PDF Manager WordPress plugin through 3.8.1 does not properly sanitise and escape a parameter before using it in a SQL statement, which could allow authenticated users with contributor-level access and above to perform SQL injection attacks and read sensitive data such as administrator...

CVE-2026-91074

The BSK PDF Manager WordPress plugin affects versions through 3.8.1 due to improper sanitization and escaping of a parameter within a SQL statement. This vulnerability specifically impacts the tags_specific shortcode attribute. Authenticated users with contributor-level access and above can explo...

CVE-2026-91074 BSK PDF Manager <= 3.8.1 - Contributor+ SQLi via tags_specific Shortcode Attribute

The BSK PDF Manager WordPress plugin through 3.8.1 does not properly sanitise and escape a parameter before using it in a SQL statement, which could allow authenticated users with contributor-level access and above to perform SQL injection attacks and read sensitive data such as administrator...

CVE-2026-107752

The Welcart e-Commerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wpuscesorderold JSON fields searchSql / searchSkuSql' parameter in all versions up to, and including, 2.12.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation o...