CVE-2026-89237

The Bluff Post WordPress plugin through 1.1.1 does not sanitise and escape parameters before using them as identifiers in a SQL query, allowing unauthenticated attackers to append additional SQL and extract sensitive information from the database...

EUVD-2026-87533

The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a value stored through one of its AJAX handlers, which lacks a capability check, before using it in a SQL statement, allowing any authenticated user, such as a subscriber, to perform SQL injection attacks whose results are...

CVE-2026-84097

The wp-review-slider-pro WordPress plugin (versions before 12.7.12 ) is vulnerable to SQL injection . The root cause is a failure to sanitize a value stored via an AJAX handler that lacks a proper capability check. This allows any authenticated user , such as a subscriber, to perform SQL injectio...

CVE-2026-84097 WP Review Slider Pro < 12.7.12 - Subscriber+ SQLi via Stored Template Filter

The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a value stored through one of its AJAX handlers, which lacks a capability check, before using it in a SQL statement, allowing any authenticated user, such as a subscriber, to perform SQL injection attacks whose results are...

CVE-2026-84097 WP Review Slider Pro < 12.7.12 - Subscriber+ SQLi via Stored Template Filter

The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a value stored through one of its AJAX handlers, which lacks a capability check, before using it in a SQL statement, allowing any authenticated user, such as a subscriber, to perform SQL injection attacks whose results are...

EUVD-2026-87527

The Bluff Post WordPress plugin through 1.1.1 does not sanitise and escape parameters before using them as identifiers in a SQL query, allowing unauthenticated attackers to append additional SQL and extract sensitive information from the database...

CVE-2026-89237 Bluff Post <= 1.1.1 - Unauthenticated SQLi via 'table_name' and 'column_name' Parameters

The Bluff Post WordPress plugin through 1.1.1 does not sanitise and escape parameters before using them as identifiers in a SQL query, allowing unauthenticated attackers to append additional SQL and extract sensitive information from the database...

CVE-2026-89237

The Bluff Post WordPress plugin (versions through 1.1.1 ) is vulnerable to an unauthenticated SQL injection . The root cause is the failure to sanitize and escape parameters—specifically the 'table_name' and 'column_name' parameters—before using them as identifiers in a SQL query. This allows an ...

CVE-2026-89237 Bluff Post <= 1.1.1 - Unauthenticated SQLi via 'table_name' and 'column_name' Parameters

The Bluff Post WordPress plugin through 1.1.1 does not sanitise and escape parameters before using them as identifiers in a SQL query, allowing unauthenticated attackers to append additional SQL and extract sensitive information from the database...

Exploit for SQL Injection in Strapi

abraxaslabs.tech · github.com/abraxas ·&...

CVE-2026-14962

CVE-2026-14962 WordPress 插件 ELEX WooCommerce Request a Quote 未认证 SQL 注入 ELEX WooCommerce Request a Quote（WordPress 插件 elex-request-a-quote）≤ 2.4.0 — 通过公开的 elexraqaddtoquote AJAX 操作实现未认证 SQL 注入。 仅限授权测试。请勿对您不拥有或未获授权测试的系统运行此工具。 要求： Python 3，仅使用标准库。目标必须运行 WooCommerce（报价脚本/nonce 会打印在商店/首页上）。 python3...

CVE-2026-100683: Improper Neutralization of Special Elements used in an SQL Command

Budibase @budibase/server before 3.45.0 builds MySQL and MSSQL column-rename DDL in packages/backend-core/src/sql/sqlTable.ts by interpolating identifiers directly into a raw query string backtick-quoted for MySQL, a single-quoted sprename literal for MSSQL without applying the project's...

PT-2026-99354

Name of the Vulnerable Software and Affected Versions Budibase @budibase/server versions prior to 3.45.0 Description An issue exists in the way MySQL and MSSQL column-rename DDL is constructed in packages/backend-core/src/sql/sqlTable.ts. The software interpolates identifiers directly into a raw...

PT-2026-99932

Name of the Vulnerable Software and Affected Versions DBI versions prior to 1.654 Description Numeric values are incorrectly treated as strings in the sql type cast svpv function. When casting to SQL NUMERIC, the sql type cast svpv function passes the string pointer and length of the SV to grok...

PT-2026-99270

Name of the Vulnerable Software and Affected Versions CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be Description A remote SQL injection exists in the file mydetailsfaculty.php. The issue occurs when the myfid argument is manipulated, allowing an attacker to...

PT-2026-99435

Name of the Vulnerable Software and Affected Versions mathurvishal CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be Description A SQL injection issue exists in the viewresult.php file. This occurs when the seno argument is manipulated, allowing for remote...

CVE-2026-89237: Improper Neutralization of Special Elements used in an SQL Command

The Bluff Post WordPress plugin through 1.1.1 does not sanitise and escape parameters before using them as identifiers in a SQL query, allowing unauthenticated attackers to append additional SQL and extract sensitive information from the database...

CVE-2026-94130: Improper Neutralization of Special Elements used in an SQL Command

Joomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gallery extension 5.7.3 - An SQL injection vulnerability in video search functionality and sorting allowed attackers to inject SQL commands in read queries...

CVE-2026-84097: Improper Neutralization of Special Elements used in an SQL Command

The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a value stored through one of its AJAX handlers, which lacks a capability check, before using it in a SQL statement, allowing any authenticated user, such as a subscriber, to perform SQL injection attacks whose results are...

CVE-2026-100739: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file viewresult.php. Performing a manipulation of the argument seno results in sql injection. Remote exploitation of the attack is...