CVE-2026-89236: Improper Neutralization of Special Elements used in an SQL Command

The SaveTo Wishlist Lite WordPress plugin before 1.1.5 does not sanitise and escape parameters before using them in the ORDER BY clause of a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database...

PT-2026-104542

Name of the Vulnerable Software and Affected Versions The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management versions prior to 8.97.1 Description An issue exists where authenticated attackers with subscriber-level access and above can perform a generic SQL Injection. This occur...

NPM: Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized window-function name

NPM: Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler POST /api/v1/query via unsanitized window-function name vulnerability discovered by ? in WordPress Npm trigger.dev versions = 4.5.5...

Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized window-function name

Summary A cross-tenant SQL injection in the TSQL query compiler lets any authenticated trigger.dev customer read every other tenant's analytics data. The customer-facing query endpoint POST /api/v1/query accepts a TSQL/TRQL query that is compiled to ClickHouse SQL by internal-packages/tsql. The...

GHSA-9Q4R-4842-93VW Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized window-function name

Summary A cross-tenant SQL injection in the TSQL query compiler lets any authenticated trigger.dev customer read every other tenant's analytics data. The customer-facing query endpoint POST /api/v1/query accepts a TSQL/TRQL query that is compiled to ClickHouse SQL by internal-packages/tsql. The...

CVE-2026-82039

UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupService.searchQueryBuilder that allows authenticated attackers to inject arbitrary SQL by supplying malicious assetType and groupName values that are inserted unsanitized into a native PostgreSQL query via String.forma...

CVE-2026-82039 UTMStack < 11.2.16 SQL Injection via searchGroupsByFilter

UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupService.searchQueryBuilder that allows authenticated attackers to inject arbitrary SQL by supplying malicious assetType and groupName values that are inserted unsanitized into a native PostgreSQL query via String.forma...

CVE-2026-82039

UTMStack versions prior to 11.2.16 are vulnerable to a SQL injection vulnerability within the UtmAssetGroupService.searchQueryBuilder() function. The flaw occurs because assetType and groupName values are inserted unsanitized into a native PostgreSQL query using String.format(). Authenticated att...

CVE-2026-82039 UTMStack < 11.2.16 SQL Injection via searchGroupsByFilter

UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupService.searchQueryBuilder that allows authenticated attackers to inject arbitrary SQL by supplying malicious assetType and groupName values that are inserted unsanitized into a native PostgreSQL query via String.forma...

EUVD-2026-91790

UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupService.searchQueryBuilder that allows authenticated attackers to inject arbitrary SQL by supplying malicious assetType and groupName values that are inserted unsanitized into a native PostgreSQL query via String.forma...

CVE-2026-82039 UTMStack < 11.2.16 SQL Injection via searchGroupsByFilter

UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupService.searchQueryBuilder that allows authenticated attackers to inject arbitrary SQL by supplying malicious assetType and groupName values that are inserted unsanitized into a native PostgreSQL query via String.forma...

WordPress Smart Manager – WooCommerce Bulk Edit: Products, Orders, Users & More (Spreadsheet) plugin <= 8.97.0 - Authenticated (Subscriber+) SQL Injection to Privilege Escalation vulnerability

Authenticated Subscriber+ SQL Injection to Privilege Escalation vulnerability discovered by lhking in WordPress Plugin Smart Manager versions = 8.97.0...

VORNEX-MTOOL

⚡ VORNEX-MTOOL – Gelişmiş Güvenlik Denetim & Sızdırma Testi Ar...

WordPress WP Visitor Statistics (Real Time Traffic) plugin <= 8.7 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Nox Axter in WordPress Plugin WP Visitor Statistics Real Time Traffic versions = 8.7...

CVE-2026-104625

A security flaw has been discovered in CodeAstro Simple Loan Management System 1.0. Impacted is an unknown function of the file /admin/index.php. Performing a manipulation of the argument gname results in sql injection. The attack may be initiated remotely. The exploit has been released to the...

CVE-2026-104625

A security flaw exists in CodeAstro Simple Loan Management System 1.0 within an unknown function of the /admin/index.php file. An attacker can perform a remote SQL injection by manipulating the g_name argument. Public exploits are available and may be used to conduct attacks. No specific remediat...

CVE-2026-104625 CodeAstro Simple Loan Management System index.php sql injection

A security flaw has been discovered in CodeAstro Simple Loan Management System 1.0. Impacted is an unknown function of the file /admin/index.php. Performing a manipulation of the argument gname results in sql injection. The attack may be initiated remotely. The exploit has been released to the...

CVE-2026-104625 CodeAstro Simple Loan Management System index.php sql injection

A security flaw has been discovered in CodeAstro Simple Loan Management System 1.0. Impacted is an unknown function of the file /admin/index.php. Performing a manipulation of the argument gname results in sql injection. The attack may be initiated remotely. The exploit has been released to the...

EUVD-2026-91650

A security flaw has been discovered in CodeAstro Simple Loan Management System 1.0. Impacted is an unknown function of the file /admin/index.php. Performing a manipulation of the argument gname results in sql injection. The attack may be initiated remotely. The exploit has been released to the...

WordPress Beaver Builder Page Builder – Drag and Drop Website Builder plugin <= 2.11.0.5 - Authenticated (Contributor+) SQL Injection vulnerability

Authenticated Contributor+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Beaver Builder versions = 2.11.0.5...