CVE-2026-14913 SQL Injection vulnerability

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.669 and below were vulnerable to an SQL Injection vulnerability in Rule Management Search Reports...

CVE-2026-14913 SQL Injection vulnerability

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.669 and below were vulnerable to an SQL Injection vulnerability in Rule Management Search Reports...

EUVD-2026-85233

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.669 and below were vulnerable to an SQL Injection vulnerability in Rule Management Search Reports...

WordPress Ultimeter plugin <= 3.0.8 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Ultimeter versions = 3.0.8...

WordPress Email Log plugin <= 2.63 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Email Log versions = 2.63...

WordPress WP EasyCart plugin <= 5.9.4 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP EasyCart versions = 5.9.4...

WordPress Mollie Forms plugin <= 2.11.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Mollie Forms versions = 2.11.0...

WordPress Live Copy Paste for Elementor plugin <= 1.5.10 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Live Copy Paste for Elementor versions = 1.5.10...

WordPress Easy Digital Downloads plugin <= 3.7.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Easy Digital Downloads versions = 3.7.0...

CVE-2026-54354

A flaw was found in MapServer, a system for developing web-based Geographic Information System GIS applications. The PostGIS runtime filter translation incorrectly processes attacker-controlled input as numeric without proper validation. This allows an unauthenticated remote attacker, with access...

CVE-2026-93368

The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to a time-based SQL Injection in all versions up to and including 2.0.1 . The root cause is insufficient escaping and a lack of sufficient preparation on the existing SQL query for the 'log' (Username) parameter. Beca...

CVE-2026-93368 Rename wp-login.php to anything you want <= 2.0.1 - Unauthenticated SQL Injection via 'log' (Username) Parameter

The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' Username Parameter in all versions up to, and including, 2.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-93368 Rename wp-login.php to anything you want <= 2.0.1 - Unauthenticated SQL Injection via 'log' (Username) Parameter

The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' Username Parameter in all versions up to, and including, 2.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

EUVD-2026-85169

The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' Username Parameter in all versions up to, and including, 2.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse

A SQL injection flaw in PostgreSQL's EXTRACT expression deparser allows an authenticated object owner to execute arbitrary SQL commands with superuser privileges. By defining a hostile database object, an attacker can achieve privilege escalation when deparsing tools like pgdump or psql inspect o...

WordPress Product Filter by WBW plugin <= 3.1.7 - SQL Injection vulnerability

SQL Injection vulnerability discovered by daroo in WordPress Plugin Product Filter by WBW versions = 3.1.7...

postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse

A SQL injection flaw in PostgreSQL's EXTRACT expression deparser allows an authenticated object owner to execute arbitrary SQL commands with superuser privileges. By defining a hostile database object, an attacker can achieve privilege escalation when deparsing tools like pgdump or psql inspect o...

WordPress Rename wp-login.php to anything you want plugin <= 2.0.1 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by nthng in WordPress Plugin Rename wp-login.php to anything you want versions = 2.0.1...

Security Bulletin: IBM SPSS Analytic Server is affected by multiple vulnerabilities in Apache Hive

Summary IBM SPSS Analytic Server is affected by multiple vulnerabilities in Apache Hive. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-49845 DESCRIPTION: SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on...

CVE-2026-91024

The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query, allowing authenticated users with Author-level access and above to perform SQL injection attacks by importing a feed they control...