WordPress SKT Addons for Elementor plugin <= 4.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin SKT Addons for Elementor versions = 4.0...

WordPress WP-Lister Lite for eBay plugin <= 3.8.11 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP-Lister Lite for eBay versions = 3.8.11...

WordPress MC Woocommerce Wishlist plugin <= 1.9.21 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin MC Woocommerce Wishlist versions = 1.9.21...

WordPress PublishPress Series plugin <= 3.1.3 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin PublishPress Series versions = 3.1.3...

CVE-2026-87963

The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthenticated attackers to perform SQL injection and read arbitrary database...

CVE-2026-87963 Yo 1.1 - 1.3.1 - Unauthenticated SQL Injection via username Parameter

The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthenticated attackers to perform SQL injection and read arbitrary database...

EUVD-2026-81385

The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthenticated attackers to perform SQL injection and read arbitrary database...

CVE-2026-87963 Yo 1.1 - 1.3.1 - Unauthenticated SQL Injection via username Parameter

The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthenticated attackers to perform SQL injection and read arbitrary database...

CVE-2026-87963

The Yo WordPress plugin (versions 1.1 through 1.3.1 ) is affected by an unauthenticated SQL injection vulnerability. The plugin does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its built-in request escaping. An ...

Exploit for CVE-2026-67401

CVE-2026-67401 — cPanel/WHM EmailTrack SQL Injection → Root RC...

PT-2026-94276

Name of the Vulnerable Software and Affected Versions PublishPress Series versions prior to 3.1.4 Description An SQL Injection issue exists that allows an administrator to execute malicious SQL queries. SQL Injection is a technique where an attacker inserts malicious SQL code into a query,...

PT-2026-94274

Editor SQL Injection in SKT Addons for Elementor = 4.0 versions...

PT-2026-94271

Name of the Vulnerable Software and Affected Versions Newsletters versions prior to 4.19 Description An SQL Injection issue exists in the administrator section, allowing an attacker to interfere with the queries that an application makes to its database. Recommendations Update to a version newer...

PT-2026-94267

Contributor SQL Injection in Product Feed Manager = 7.12.0 versions...

PT-2026-94275

Shop manager SQL Injection in WP-Lister Lite for eBay = 3.8.11 versions...

PT-2026-95006

Name of the Vulnerable Software and Affected Versions SigNoz versions 0.88.0 through 0.142.0 Description Authenticated attackers can execute arbitrary SQL queries and retrieve results in HTTP responses. This occurs because the trace-funnel analytics endpoints interpolate the service name and span...

PT-2026-94185

Name of the Vulnerable Software and Affected Versions Yo WordPress plugin versions 1.1 through 1.3.1 Description An issue exists where the software fails to sanitize or parameterize the username request parameter before incorporating it into a SQL query. Because the parameter is read before...

PT-2026-94226

Name of the Vulnerable Software and Affected Versions Snowflake CLI versions prior to 3.27.0 Description Improper input validation allows unsanitized user-controlled values to be interpolated into SQL strings executed as multi-statement queries. An attacker can execute arbitrary SQL statements...

CVE-2025-55787

In MailData Email Archiving System v4.2 and earlier, a SQL injection vulnerability exists...

CVE-2026-54524: Improper Neutralization of Special Elements used in an SQL Command

Frappe HR is an open-source human resources management solution HRMS. Prior to 16.7.0, an authenticated user with the HR User role can inject SQL through filters in the Salary Payments Based on Payment Mode report. In...