285142 matches found
CVE-2026-87963
The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthenticated attackers to perform SQL injection and read arbitrary database...
CVE-2026-87963 Yo 1.1 - 1.3.1 - Unauthenticated SQL Injection via username Parameter
The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthenticated attackers to perform SQL injection and read arbitrary database...
CVE-2026-87963 Yo 1.1 - 1.3.1 - Unauthenticated SQL Injection via username Parameter
The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthenticated attackers to perform SQL injection and read arbitrary database...
EUVD-2026-81385
The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthenticated attackers to perform SQL injection and read arbitrary database...
CVE-2026-87963
The Yo WordPress plugin (versions 1.1 through 1.3.1 ) is affected by an unauthenticated SQL injection vulnerability. The plugin does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its built-in request escaping. An ...
Exploit for CVE-2026-67401
CVE-2026-67401 — cPanel/WHM EmailTrack SQL Injection → Root RC...
PT-2026-94271
Name of the Vulnerable Software and Affected Versions Newsletters versions prior to 4.19 Description An SQL Injection issue exists in the administrator section, allowing an attacker to interfere with the queries that an application makes to its database. Recommendations Update to a version newer...
CVE-2026-79752: Improper Neutralization of Special Elements used in an SQL Command
CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit valu...
CVE-2026-93292: Improper Neutralization of Special Elements used in an SQL Command
SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints that interpolate servicename and spanname fields into ClickHouse string literals without escaping. Authenticated attackers can inject SQL through funnel step definitions to execute...
CVE-2026-54524: Improper Neutralization of Special Elements used in an SQL Command
Frappe HR is an open-source human resources management solution HRMS. Prior to 16.7.0, an authenticated user with the HR User role can inject SQL through filters in the Salary Payments Based on Payment Mode report. In...
CVE-2026-87963: Improper Neutralization of Special Elements used in an SQL Command
The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthenticated attackers to perform SQL injection and read arbitrary database...
CVE-2026-66619: Improper Neutralization of Special Elements used in an SQL Command
Administrator SQL Injection in Newsletters = 4.18 versions...
CVE-2026-66625: Improper Neutralization of Special Elements used in an SQL Command
Administrator SQL Injection in WC Vendors Marketplace = 2.7.2.1 versions...
CVE-2026-66624: Improper Neutralization of Special Elements used in an SQL Command
Administrator SQL Injection in WPMasterToolKit = 2.22.0 versions...
CVE-2026-66626: Improper Neutralization of Special Elements used in an SQL Command
Editor SQL Injection in SKT Addons for Elementor = 4.0 versions...
CVE-2026-66630: Improper Neutralization of Special Elements used in an SQL Command
Administrator SQL Injection in PublishPress Series = 3.1.3 versions...
CVE-2026-53556: Improper Neutralization of Special Elements used in an SQL Command
SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/previewData endpoint in backend/apps/datasource/crud/datasource.py incorporates the client-controlled tablename value into generated SQL without safe identifier handling...
CVE-2026-54646: Improper Neutralization of Special Elements used in an SQL Command
CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablename values into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE statements without validating the identifiers or escaping embedded backticks. An authenticated...
CVE-2026-54354: Improper Neutralization of Special Elements used in an SQL Command
MapServer is a system for developing web-based GIS applications. Prior to 8.6.4, MapServer's PostGIS runtime filter translation in src/mappostgis.cpp and msPostGISLayerTranslateFilter treats a filteritem as numeric when CONNECTIONTYPE POSTGIS and metadata such as gml type=Integer are configured,...