PT-2026-113976

DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store a crafted custom dateFormat for a dataset field. DatasetTableFieldDTO.dateFormat is inserted without validation into date conversion templates used by Dimension2SQLObj, CustomWhere2Str...

CVE-2026-95808: Improper Neutralization of Special Elements used in an SQL Command

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via the 'inputs' parameter in all versions up to, and including, 1.15.48 due to insufficient escaping on the user supplied parameter and lack of sufficient...

PT-2026-114216

Name of the Vulnerable Software and Affected Versions e107 versions prior to 2.3.7 Description The bundled alt auth plugin in this content management system CMS contains a flaw in the otherdb and e107db authentication backends. The login methods in e107 plugins/alt auth/otherdb auth.php and e107...

PT-2026-113654

The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it in a SQL statement, and verifies its payment webhook with a signing secret that is empty by default, allowing unauthenticated attackers to perform SQL...

PT-2026-113624

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via the 'inputs' parameter in all versions up to, and including, 1.15.48 due to insufficient escaping on the user supplied parameter and lack of sufficient...

PT-2026-113688

The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database...

PT-2026-113689

Name of the Vulnerable Software and Affected Versions WMS MobileServer affected versions not specified Description The authorization middleware fails to enforce authentication in two scenarios. First, authentication is only required for GET and HEAD requests, meaning other HTTP methods are...

PT-2026-113702

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Codepeople CP Multi View Event Calendar cp-multi-view-calendar allows SQL Injection.This issue affects CP Multi View Event Calendar : from n/a through 1.4.41...

CVE-2026-110668: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in cemtan sar2html 4.0.0. Affected by this issue is the function index of the file sar2html.py. This manipulation of the argument sort causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and coul...

CVE-2026-55572: Improper Neutralization of Special Elements used in an SQL Command

e107 is a content management system CMS. Prior to 2.3.7, the bundled altauth plugin's otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107plugins/altauth/otherdbauth.php and e107plugins/altauth/e107dbauth.php. The login methods execute thos...

CVE-2026-108065: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection CWE-89 in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce VERSION — missing allows an unauthenticated remote attacker to read, write, and potentially execute commands on the backend Microsoft SQL Server via a crafted sUserID...

PT-2026-114200

Redash is a package for data visualization and sharing. From versions after 8.0.0 until 26.9.0, the Query Results query runner in redash/query runner/query results.py accepts param query N key=value parameters and passed attacker-controlled values to replace query parameters for raw substitution...

CVE-2026-89288: Improper Neutralization of Special Elements used in an SQL Command

The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database...

PT-2026-113714

Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/cat issues top.pl script sub calculate concatenates the user-controlled Criteria, Filter, and Limit request parameters directly into dynamic SQL. Criteria is only prefix-normalized and never validated against an...

PT-2026-114104

Name of the Vulnerable Software and Affected Versions cemtan sar2html version 4.0.0 Description A remote SQL injection is possible due to improper handling of the sort argument within the index function of the sar2html.py file. SQL injection is a technique where an attacker inserts malicious SQL...

PT-2026-114222

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro cobranca.php endpoint accepts POST input through extract$ REQUEST and directly incorporates valor, valor pago, id pessoa, id socio, and id sociotipo into UPDATE, INSERT, and...

CVE-2026-102251: Improper Neutralization of Special Elements used in an SQL Command

The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'validate' parameter in all versions up to, and including, 10.8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...

PT-2026-114002

Name of the Vulnerable Software and Affected Versions Channel Software WebAlliance eCommerce affected versions not specified Description An unauthenticated remote attacker can perform a SQL Injection CWE-89, which is a flaw where malicious SQL statements are inserted into entry fields for...

PT-2026-113602

The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'validate' parameter in all versions up to, and including, 10.8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...

PT-2026-113626

Name of the Vulnerable Software and Affected Versions Gmedia Photo Gallery versions prior to 1.25.2 Description The plugin is subject to time-based SQL Injection, a technique where an attacker sends a query that forces the database to wait a specific amount of time before responding, allowing the...