265212 matches found
FreePBX-SQLi-RCE
FreePBX CVE-2025-57819 - Unauthenticated SQLi to RCE PoC Educational & Security Research Only - See Legal Notice Below Exploitation proof of concept for CVE-2025-57819, a critical unauthenticated SQL injection vulnerability in FreePBX that allows remote code execution. This PoC is published after...
Anthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploits Injection Flaws
Anthropic on Friday said it's cutting off live internet access for all its internal evaluations until further notice following the discovery of new incidents in which its artificial intelligence AI models exhibited misaligned behavior and targeted real websites. The AI company said it identified...
Exploit for CVE-2026-102428
CVE-2026-102428 — OrdaSoft OS CCK comoscck unauthenticated...
CVE-2026-96662
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection via 'bookingserviceid' Parameter in all versions up to, and including, 5.7.2 due to insufficient escaping on the user supplied parameter and lack of...
CVE-2026-96653
The WP Directory Kit plugin for WordPress is vulnerable to time-based SQL Injection via 'displayname' Profile Field Second-Order in all versions up to, and including, 1.5.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...
EUVD-2026-96283
The WP Directory Kit plugin for WordPress is vulnerable to time-based SQL Injection via 'displayname' Profile Field Second-Order in all versions up to, and including, 1.5.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...
CVE-2026-96653 WP Directory Kit <= 1.5.9 - Authenticated (Subscriber+) SQL Injection via 'display_name' Profile Field (Second-Order)
The WP Directory Kit plugin for WordPress is vulnerable to time-based SQL Injection via 'displayname' Profile Field Second-Order in all versions up to, and including, 1.5.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...
CVE-2026-96653
The WP Directory Kit plugin for WordPress (versions
CVE-2026-96653 WP Directory Kit <= 1.5.9 - Authenticated (Subscriber+) SQL Injection via 'display_name' Profile Field (Second-Order)
The WP Directory Kit plugin for WordPress is vulnerable to time-based SQL Injection via 'displayname' Profile Field Second-Order in all versions up to, and including, 1.5.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...
CVE-2026-96662 Appointment Booking Plugin <= 5.7.2 - Unauthenticated SQL Injection via 'booking[service_id]' Parameter
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection via 'bookingserviceid' Parameter in all versions up to, and including, 5.7.2 due to insufficient escaping on the user supplied parameter and lack of...
CVE-2026-96662
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection via 'bookingserviceid' Parameter in all versions up to, and including, 5.7.2 due to insufficient escaping on the user supplied parameter and lack of...
CVE-2026-96662 Appointment Booking Plugin <= 5.7.2 - Unauthenticated SQL Injection via 'booking[service_id]' Parameter
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection via 'bookingserviceid' Parameter in all versions up to, and including, 5.7.2 due to insufficient escaping on the user supplied parameter and lack of...
EUVD-2026-96276
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection via 'bookingserviceid' Parameter in all versions up to, and including, 5.7.2 due to insufficient escaping on the user supplied parameter and lack of...
CVE-2026-107712
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the 'currentmonth' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
EUVD-2026-96215
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the 'currentmonth' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
CVE-2026-107712
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to a time-based SQL Injection in all versions up to and including 2.1.0.1 . The root cause is insufficient escaping and a lack of sufficient preparation on the user-supplied 'current_month' parameter. This is a regression...
CVE-2026-107712 WP Booking System <= 2.1.0.1 - Authenticated (Subscriber+) SQL Injection via 'current_month' Parameter
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the 'currentmonth' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
CVE-2026-107712 WP Booking System <= 2.1.0.1 - Authenticated (Subscriber+) SQL Injection via 'current_month' Parameter
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the 'currentmonth' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
CVE-2026-87781
The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...
CVE-2026-104753
The Rank Math SEO WordPress plugin before 1.0.280 does not properly sanitise and escape a parameter before using it in a SQL query, allowing high-privilege users such as administrators to perform SQL injection attacks...