CVE-2026-94115: Improper Neutralization of Special Elements used in an SQL Command

Contributor SQL Injection in Easy Pricing Tables = 4.1.2 versions...

CVE-2026-93621: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in WP Data Access = 5.5.84 versions...

CVE-2026-94082: Improper Neutralization of Special Elements used in an SQL Command

Author SQL Injection in Quiz Cat = 3.1.1 versions...

CVE-2026-62085: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in WP Activity Log = 5.6.6 versions...

CVE-2026-102109: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability existed in Kiteworks Secure Data Forms, where a value derived from the authenticated user's stored account data was incorporated into a database query without proper sanitization. An authenticated user could potentially influence that value to inject SQL. Exploitatio...

CVE-2026-102098: Improper Neutralization of Special Elements used in an SQL Command

Kiteworks Core before version 9.5.0 is vulnerable to SQL Injection. A stored SQL injection vulnerability in a Kiteworks administrative reporting feature could allow an authenticated administrator to read sensitive data from the underlying database and to affect the availability of the service...

CVE-2026-102913: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in SourceCodester Car Driving School Management System 1.0. Impacted is an unknown function of the file /classes/Master.php?f=saveenrollment. The manipulation results in sql injection. The attack can be executed remotely. The exploit has been released to the...

CVE-2026-102912: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in SourceCodester Online Leave Management System 1.0. This issue affects some unknown processing of the file /admin/?page=reports. The manipulation of the argument datestart/dateend leads to sql injection. Remote exploitation of the attack is possible. The exploit i...

CVE-2026-102910: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /reviewer0/admins/assessments/examproper/exam-delete.php. The manipulation of the argument testid results in sql injection. The attack can be launch...

CVE-2026-102909: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer0/admins/assessments/examproper/btnfunctions.php. The manipulation of the argument accesscode leads to sql injection. The attack can be initiated remotely...

CVE-2026-51936: Improper Neutralization of Special Elements used in an SQL Command

Zetetic SQLCipher before 4.15.0 allows SQL injection. The sqlcipherexport convenience function can be used to copy the contents of one attached database into another. It is most often used to convert between plaintext and encrypted databases. It needs to do dynamic schema manipulation, and thus t...

CVE-2026-103115: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in OS4ED openSIS-Classic up to 9.3. This affects an unknown function of the file functions/CustomFieldsFnc.php of the component Student Search. The manipulation of the argument cust results in sql injection. It is possible to launch the attack remotely. The...

CVE-2026-103114: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in OS4ED openSIS-Classic up to 9.3. The impacted element is the function DBQueryassignment of the file modules/grades/Assignments.php of the component Assignment Management Endpoint. The manipulation of the argument Tables leads to sql injection. It is possible to...

CVE-2026-102578: Improper Neutralization of Special Elements used in an SQL Command

A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL Structured Query Language injection vulnerability. This issue could allow an attacker to view, alter, or delete...

CVE-2026-102456: Improper Neutralization of Special Elements used in an SQL Command

EasyFlow .NET developed by Digiwin has an SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read database contents...

CVE-2026-16596: Improper Neutralization of Special Elements used in an SQL Command

The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'datafieldslist' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2026-103232: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This affects the function mysqliquery of the file admin/tablebooking.php. This manipulation of the argument Name causes sql injection. Remote exploitation of the attack is...

VulnCheck KEV: CVE-2020-22209

SQL Injection in 74cms 3.2.0 via the query parameter to plus/ajaxcommon.php...

WordPress WPML Multilingual & Multicurrency for WooCommerce plugin <= 5.5.7 - Authenticated (Shop Manager+) SQL Injection vulnerability

Authenticated Shop Manager+ SQL Injection vulnerability discovered by Muni Nitish Kumar Yaddala Stranger825 in WordPress Plugin WooCommerce Multilingual & Multicurrency versions = 5.5.7...

Iron Mountain enVision 260654 Authenticated SQL Injection

Iron Mountain enVision versions before 260655 contain an authenticated SQL injection vulnerability in the DocumentModule document-listing and detailed-search sorting parameter...