WordPress Booktics plugin 1.0.22 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Abdullah Kareem "cyberkareem" in WordPress Plugin Booktics versions 1.0.22...

WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Jayant Kamble in WordPress Plugin WP Directory Kit versions = 1.5.4...

CVE-2026-17346

A flaw was found in pgAdmin 4. A low-privileged user can exploit a SQL injection vulnerability when object names, such as schema, table, publication, or subscription names, containing special characters are not properly escaped. When any user, including those with higher privileges, views the...

CVE-2025-41771

An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limited to the system’s notification...

vulnerabilities in Adobe Campaign Classic

Adobe has identified vulnerabilities in Adobe Campaign Classic. These vulnerabilities allow attackers to execute arbitrary code without user interaction. One of the vulnerabilities involves incorrect authorization, allowing attackers to perform actions beyond the intended permissions. Another...

EUVD-2025-210707

An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limited to the system’s notification...

CVE-2025-41771 SQL injection

An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limited to the system’s notification...

CVE-2025-41771

An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limited to the system’s notification...

CVE-2025-41771

CVE-2025-41771 details an SQL injection vulnerability exploitable by an authenticated user with low privileges via an endpoint in the controller’s web interface. The flaw affects a SQLite database used solely for storing notification messages, so the impact is limited to the system’s notification...

GHSA-VWF4-M7J8-WCJF

creationtimestamp| type| source ---|---|--- 2026-08-12 08:00:05+00:00| seen| Telegram/ZtTgk35S8DFYm2bUVjFVqqtPnGYEzTcbCUrks9IGhgQhA 2026-08-13 00:00:43+00:00| published-proof-of-concept| Telegram/ZtTgk35S8DFYm2bUVjFVqqtPnGYEzTcbCUrks9IGhgQhA 2026-08-16 20:29:14+00:00| seen|...

CVE-2026-66659

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Essekia Tablesome Table allows Blind SQL Injection. This issue affects Tablesome Table: from n/a through 1.2.9...

CVE-2026-18474

The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when a non-default search field type is configured...

CVE-2026-18230

The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks an authorization check, allowing any authenticated user such as a Subscriber to perform SQL injection attacks...

CVE-2026-18057

The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled value before using it in a SQL statement, allowing users with a subscriber account and above to perform SQL injection attacks and tamper with booking consent records belonging to other people...

CVE-2026-16977

The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for a database-backed choice field, allowing subscriber-level users to perform second-order SQL injection...

CVE-2026-13613

The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before using them in a SQL query, allowing authenticated users with a clinic staff-level role to perform SQL injection...

CVE-2026-66659 WordPress Tablesome Table plugin <= 1.2.9 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Essekia Tablesome Table allows Blind SQL Injection. This issue affects Tablesome Table: from n/a through 1.2.9...

EUVD-2026-57109

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Essekia Tablesome Table allows Blind SQL Injection. This issue affects Tablesome Table: from n/a through 1.2.9...

CVE-2026-66659

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Essekia Tablesome Table allows Blind SQL Injection. This issue affects Tablesome Table: from n/a through 1.2.9...

CVE-2026-66659

CVE-2026-66659 describes an SQL Injection vulnerability in the WordPress plugin “Tablesome Table” (Essekia) affected versions up to 1.2.9. The root cause is improper neutralization of special elements in SQL commands, leading to Blind SQL Injection. Impact is listed as high for confidentiality an...