CVE-2026-104122

The Ukr-To-Lat WordPress plugin, in versions through 1.3.5 , is vulnerable to SQL injection due to a failure to sanitize and escape a term name before utilizing it in a SQL query. This flaw allows users with Contributor-level access and above to execute unauthorized SQL commands. No specific reme...

CVE-2026-104122 Ukr-To-Lat <= 1.3.5 - Contributor+ SQLi via Term Name

The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQL query, allowing users with Contributor-level access and above to perform SQL injection attacks...

EUVD-2026-103249

The BSK PDF Manager WordPress plugin through 3.8.1 does not properly sanitise and escape a parameter before using it in a SQL statement, which could allow authenticated users with contributor-level access and above to perform SQL injection attacks and read sensitive data such as administrator...

CVE-2026-91074 BSK PDF Manager <= 3.8.1 - Contributor+ SQLi via tags_specific Shortcode Attribute

The BSK PDF Manager WordPress plugin through 3.8.1 does not properly sanitise and escape a parameter before using it in a SQL statement, which could allow authenticated users with contributor-level access and above to perform SQL injection attacks and read sensitive data such as administrator...

CVE-2026-91074

The BSK PDF Manager WordPress plugin affects versions through 3.8.1 due to improper sanitization and escaping of a parameter within a SQL statement. This vulnerability specifically impacts the tags_specific shortcode attribute. Authenticated users with contributor-level access and above can explo...

CVE-2026-91074 BSK PDF Manager <= 3.8.1 - Contributor+ SQLi via tags_specific Shortcode Attribute

The BSK PDF Manager WordPress plugin through 3.8.1 does not properly sanitise and escape a parameter before using it in a SQL statement, which could allow authenticated users with contributor-level access and above to perform SQL injection attacks and read sensitive data such as administrator...

CVE-2026-107752

The Welcart e-Commerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wpuscesorderold JSON fields searchSql / searchSkuSql' parameter in all versions up to, and including, 2.12.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation o...

CVE-2026-107752

The Welcart e-Commerce plugin for WordPress is vulnerable to SQL Injection in versions up to and including 2.12.4 . The root cause is insufficient escaping on the user-supplied 'wp_usces_order_old' cookie (specifically the searchSql and searchSkuSql JSON fields) and a lack of sufficient preparati...

CVE-2026-107752 Welcart e-Commerce <= 2.12.4 - Authenticated (Editor+) SQL Injection via 'wp_usces_order_old' Cookie

The Welcart e-Commerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wpuscesorderold JSON fields searchSql / searchSkuSql' parameter in all versions up to, and including, 2.12.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation o...

EUVD-2026-103221

The Welcart e-Commerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wpuscesorderold JSON fields searchSql / searchSkuSql' parameter in all versions up to, and including, 2.12.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation o...

CVE-2026-107752 Welcart e-Commerce <= 2.12.4 - Authenticated (Editor+) SQL Injection via 'wp_usces_order_old' Cookie

The Welcart e-Commerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wpuscesorderold JSON fields searchSql / searchSkuSql' parameter in all versions up to, and including, 2.12.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation o...

Exploit for CVE-2026-107083

CVE-2026-107083 — SQL Injection via Unquoted Numeric Concatena...

pythonSQLInjection_Practica

Simulación y Mitigación de SQL Injection 1. Descripción de...

Exploit for CVE-2026-107082

CVE-2026-107082 — SQL Injection via opachide / promoted G...

PT-2026-116505

A weakness has been identified in nemoTyrant manong up to 7c9e5228e133b9267ad3a415833bc9bb53193bb4. This impacts the function cache/del cache/arr2sql of the file func.php. This manipulation causes sql injection. The attack may be initiated remotely. This product uses a rolling release model to...

CVE-2026-107752: Improper Neutralization of Special Elements used in an SQL Command

The Welcart e-Commerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wpuscesorderold JSON fields searchSql / searchSkuSql' parameter in all versions up to, and including, 2.12.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation o...

Vedo Suite 1.2.5 SQL Injection

Vedo Suite version 1.2.5 contains an authenticated SQL injection issue in its chat API endpoint that may permit operating-system command execution through an enabled SQL Server xpcmdshell configuration...

CVE-2026-104122: Improper Neutralization of Special Elements used in an SQL Command

The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQL query, allowing users with Contributor-level access and above to perform SQL injection attacks...

Apache Log4j 1.2.17 JDBCAppender SQL Injection

Apache Log4j version 1.2.17 JDBCAppender contains an SQL injection vulnerability when an unescaped logging message is embedded in a JDBCAppender SQL pattern. This package provides an isolated H2 proof of concept and whitebox data-flow report. https://packetstorm.news/download/236092...

PT-2026-116354

Name of the Vulnerable Software and Affected Versions Welcart e-Commerce versions prior to 2.12.5 Description The Welcart e-Commerce plugin for WordPress contains a SQL Injection flaw. Authenticated attackers with editor-level access or higher can append malicious SQL queries to existing ones due...