265208 matches found
CVE-2026-42633: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in Events Manager = 7.4.6 versions...
CVE-2026-96653: Improper Neutralization of Special Elements used in an SQL Command
The WP Directory Kit plugin for WordPress is vulnerable to time-based SQL Injection via 'displayname' Profile Field Second-Order in all versions up to, and including, 1.5.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...
PT-2026-109506
The Rank Math SEO WordPress plugin before 1.0.280 does not properly sanitise and escape a parameter before using it in a SQL query, allowing high-privilege users such as administrators to perform SQL injection attacks...
PT-2026-109553
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the 'current month' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQ...
CVE-2026-104023: Improper Neutralization of Special Elements used in an SQL Command
The Smart Popup by Supsystic plugin for WordPress is vulnerable to generic SQL Injection via the 'sidx' parameter in all versions up to, and including, 1.13.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...
CVE-2026-107712: Improper Neutralization of Special Elements used in an SQL Command
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the 'currentmonth' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
CVE-2026-104724: Improper Neutralization of Special Elements used in an SQL Command
The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to generic SQL Injection via FireBox Form Display Condition in all versions up to, and including, 3.1.13 due to insufficient escaping on the user supplied parameter and la...
CVE-2026-42717: Improper Neutralization of Special Elements used in an SQL Command
Administrator SQL Injection in Leyka = 3.32.3 versions...
CVE-2026-108604: Incorrect Authorization
Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP runquery safety gate that allows prompt-injected agents or untrusted MCP clients to bypass read-only mode by submitting side-effecting SELECT statements. Attackers can run statements like SELECT setval, nextval,...
PT-2026-109837
Name of the Vulnerable Software and Affected Versions Barcode Scanner with Inventory & Order Manager versions prior to 1.13.2 Description An SQL Injection issue exists in the subscriber component, allowing an attacker to interfere with the application's database queries. Recommendations Update...
PT-2026-109780
Name of the Vulnerable Software and Affected Versions Leyka versions prior to 3.32.4 Description An SQL Injection issue exists in the administrator section, allowing an attacker to interfere with the queries that an application makes to its database. Recommendations Update to a version newer than...
CVE-2026-87781: Improper Neutralization of Special Elements used in an SQL Command
The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...
OrdaSoft Joomla CCK 8.3.15 SQL Injection
OrdaSoft Joomla CCK versions 1.0.0 through 8.3.15 contain an unauthenticated SQL injection vulnerability in record sorting. A proof of concept is included. https://packetstorm.news/download/235077...
CVE-2026-62117: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in Barcode Scanner with Inventory & Order Manager = 1.13.1 versions...
CVE-2026-42722: Improper Neutralization of Special Elements used in an SQL Command
Administrator SQL Injection in Frontend Admin by DynamiApps = 3.29.13 versions...
CVE-2026-108474: Improper Neutralization of Special Elements used in an SQL Command
In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions...
CVE-2026-40800: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes = 1.5.3 versions...
CVE-2026-104753: Improper Neutralization of Special Elements used in an SQL Command
The Rank Math SEO WordPress plugin before 1.0.280 does not properly sanitise and escape a parameter before using it in a SQL query, allowing high-privilege users such as administrators to perform SQL injection attacks...
PT-2026-109534
The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...