CVE-2026-84097

The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a value stored through one of its AJAX handlers, which lacks a capability check, before using it in a SQL statement, allowing any authenticated user, such as a subscriber, to perform SQL injection attacks whose results are...

CVE-2026-89237

The Bluff Post WordPress plugin through 1.1.1 does not sanitise and escape parameters before using them as identifiers in a SQL query, allowing unauthenticated attackers to append additional SQL and extract sensitive information from the database...

EUVD-2026-87533

The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a value stored through one of its AJAX handlers, which lacks a capability check, before using it in a SQL statement, allowing any authenticated user, such as a subscriber, to perform SQL injection attacks whose results are...

CVE-2026-84097

The wp-review-slider-pro WordPress plugin (versions before 12.7.12 ) is vulnerable to SQL injection . The root cause is a failure to sanitize a value stored via an AJAX handler that lacks a proper capability check. This allows any authenticated user , such as a subscriber, to perform SQL injectio...

CVE-2026-84097 WP Review Slider Pro < 12.7.12 - Subscriber+ SQLi via Stored Template Filter

The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a value stored through one of its AJAX handlers, which lacks a capability check, before using it in a SQL statement, allowing any authenticated user, such as a subscriber, to perform SQL injection attacks whose results are...

CVE-2026-84097 WP Review Slider Pro < 12.7.12 - Subscriber+ SQLi via Stored Template Filter

The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a value stored through one of its AJAX handlers, which lacks a capability check, before using it in a SQL statement, allowing any authenticated user, such as a subscriber, to perform SQL injection attacks whose results are...

EUVD-2026-87527

The Bluff Post WordPress plugin through 1.1.1 does not sanitise and escape parameters before using them as identifiers in a SQL query, allowing unauthenticated attackers to append additional SQL and extract sensitive information from the database...

CVE-2026-89237 Bluff Post <= 1.1.1 - Unauthenticated SQLi via 'table_name' and 'column_name' Parameters

The Bluff Post WordPress plugin through 1.1.1 does not sanitise and escape parameters before using them as identifiers in a SQL query, allowing unauthenticated attackers to append additional SQL and extract sensitive information from the database...

CVE-2026-89237 Bluff Post <= 1.1.1 - Unauthenticated SQLi via 'table_name' and 'column_name' Parameters

The Bluff Post WordPress plugin through 1.1.1 does not sanitise and escape parameters before using them as identifiers in a SQL query, allowing unauthenticated attackers to append additional SQL and extract sensitive information from the database...

CVE-2026-89237

The Bluff Post WordPress plugin (versions through 1.1.1 ) is vulnerable to an unauthenticated SQL injection . The root cause is the failure to sanitize and escape parameters—specifically the 'table_name' and 'column_name' parameters—before using them as identifiers in a SQL query. This allows an ...

Exploit for SQL Injection in Strapi

abraxaslabs.tech · github.com/abraxas ·&...

CVE-2026-14962

CVE-2026-14962 WordPress 插件 ELEX WooCommerce Request a Quote 未认证 SQL 注入 ELEX WooCommerce Request a Quote（WordPress 插件 elex-request-a-quote）≤ 2.4.0 — 通过公开的 elexraqaddtoquote AJAX 操作实现未认证 SQL 注入。 仅限授权测试。请勿对您不拥有或未获授权测试的系统运行此工具。 要求： Python 3，仅使用标准库。目标必须运行 WooCommerce（报价脚本/nonce 会打印在商店/首页上）。 python3...

PT-2026-99269

Name of the Vulnerable Software and Affected Versions CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be Description A remote SQL injection is possible due to the improper handling of the eno argument within the updatedetailsfromstudent.php file. SQL injection is a...

CVE-2026-100683: Improper Neutralization of Special Elements used in an SQL Command

Budibase @budibase/server before 3.45.0 builds MySQL and MSSQL column-rename DDL in packages/backend-core/src/sql/sqlTable.ts by interpolating identifiers directly into a raw query string backtick-quoted for MySQL, a single-quoted sprename literal for MSSQL without applying the project's...

PT-2026-99354

Name of the Vulnerable Software and Affected Versions Budibase @budibase/server versions prior to 3.45.0 Description An issue exists in the way MySQL and MSSQL column-rename DDL is constructed in packages/backend-core/src/sql/sqlTable.ts. The software interpolates identifiers directly into a raw...

PT-2026-99270

Name of the Vulnerable Software and Affected Versions CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be Description A remote SQL injection exists in the file mydetailsfaculty.php. The issue occurs when the myfid argument is manipulated, allowing an attacker to...

PT-2026-99435

Name of the Vulnerable Software and Affected Versions mathurvishal CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be Description A SQL injection issue exists in the viewresult.php file. This occurs when the seno argument is manipulated, allowing for remote...

CVE-2026-89237: Improper Neutralization of Special Elements used in an SQL Command

The Bluff Post WordPress plugin through 1.1.1 does not sanitise and escape parameters before using them as identifiers in a SQL query, allowing unauthenticated attackers to append additional SQL and extract sensitive information from the database...

CVE-2026-84097: Improper Neutralization of Special Elements used in an SQL Command

The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a value stored through one of its AJAX handlers, which lacks a capability check, before using it in a SQL statement, allowing any authenticated user, such as a subscriber, to perform SQL injection attacks whose results are...

CVE-2026-100739: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file viewresult.php. Performing a manipulation of the argument seno results in sql injection. Remote exploitation of the attack is...