282998 matches found
CVE-2026-85568
The Unlimited Elements for Elementor WordPress plugin, in versions before 2.0.21 , is vulnerable to SQL injection because it fails to correctly handle a search value before rewriting an already prepared SQL statement. This flaw allows unauthenticated users to perform SQL injection attacks and ret...
CVE-2026-103913 GeoDirectory <= 2.8.186 - Unauthenticated SQL Injection via 'latitude' Parameter via Stored Pending Listing
The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the stored latitude/longitude coordinates of a listing in versions up to, and including, 2.8.186. This is due to insufficient escaping and the absence of numeric validation on coordinate values when a listing is saved,...
CVE-2026-103913 GeoDirectory <= 2.8.186 - Unauthenticated SQL Injection via 'latitude' Parameter via Stored Pending Listing
The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the stored latitude/longitude coordinates of a listing in versions up to, and including, 2.8.186. This is due to insufficient escaping and the absence of numeric validation on coordinate values when a listing is saved,...
EUVD-2026-91921
The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the stored latitude/longitude coordinates of a listing in versions up to, and including, 2.8.186. This is due to insufficient escaping and the absence of numeric validation on coordinate values when a listing is saved,...
CVE-2026-103913
The GeoDirectory plugin for WordPress (versions up to and including 2.8.186 ) is vulnerable to SQL Injection . The flaw stems from a lack of numeric validation and insufficient escaping of latitude/longitude coordinates when a listing is saved. These values are later directly interpolated into a ...
CVE-2026-94539
The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to time-based SQL Injection via the 'sortby' parameter in all versions up to, and including, 3.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient...
CVE-2026-95865
The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to blind SQL Injection via 'fieldsvalue' Parameter in all versions up to, and including, 2.11.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...
CVE-2026-94539
The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to a time-based SQL Injection in all versions up to and including 3.5.3 . The flaw exists due to insufficient escaping and a lack of sufficient preparation on the user-supplied 'sort_by' p...
CVE-2026-94539 SupportCandy <= 3.5.3 - Authenticated (Custom+) SQL Injection via 'sort_by' Parameter
The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to time-based SQL Injection via the 'sortby' parameter in all versions up to, and including, 3.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient...
EUVD-2026-91879
The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to time-based SQL Injection via the 'sortby' parameter in all versions up to, and including, 3.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient...
CVE-2026-94539 SupportCandy <= 3.5.3 - Authenticated (Custom+) SQL Injection via 'sort_by' Parameter
The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to time-based SQL Injection via the 'sortby' parameter in all versions up to, and including, 3.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient...
EUVD-2026-91875
The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to blind SQL Injection via 'fieldsvalue' Parameter in all versions up to, and including, 2.11.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...
CVE-2026-95865
The Beaver Builder Page Builder plugin for WordPress is vulnerable to blind SQL Injection in all versions up to and including 2.11.0.5 . The root cause is insufficient escaping of the fields[][value] parameter and a lack of sufficient preparation on the existing SQL query. Authenticated attackers...
CVE-2026-95865 Beaver Builder Page Builder <= 2.11.0.5 - Authenticated (Contributor+) SQL Injection via 'fields[][value]' Parameter
The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to blind SQL Injection via 'fieldsvalue' Parameter in all versions up to, and including, 2.11.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...
CVE-2026-95865 Beaver Builder Page Builder <= 2.11.0.5 - Authenticated (Contributor+) SQL Injection via 'fields[][value]' Parameter
The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to blind SQL Injection via 'fieldsvalue' Parameter in all versions up to, and including, 2.11.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...
CVE-2024-9465
CVE-2024-9465 Injection SQL Checkpoint via attaque temporelle CVE-2024-9465 RECHERCHE SHODAN https://www.shodan.io/search?query=html%3A%22Expedition+Project%22 html:"Expedition Project" RECHERCHE FOFA https://en.fofa.info/ body="Expedition Project" || title="Expedition Project" UTILISATION python...
PT-2026-104524
Name of the Vulnerable Software and Affected Versions Unlimited Elements for Elementor WordPress plugin versions prior to 2.0.21 Description An issue exists where search values are not correctly handled before rewriting a prepared SQL statement. This allows unauthenticated users to perform SQL...
PT-2026-104549
Name of the Vulnerable Software and Affected Versions WP Visitor Statistics Real Time Traffic versions prior to 8.8 Description An unauthenticated attacker can perform a second-order SQL injection by submitting a crafted referrer URL to the 'wmcTrack' tracking endpoint. The application fails to...
PT-2026-104504
Name of the Vulnerable Software and Affected Versions GeoDirectory versions prior to 2.8.187 Description Insufficient escaping and a lack of numeric validation on coordinate values when saving a listing allow authenticated attackers with Subscriber-level access or higher to perform SQL Injection...
PT-2026-104485
The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to time-based SQL Injection via the 'sort by' parameter in all versions up to, and including, 3.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient...