CVE-2026-15602

CVE-2026-15602 affects the NEX-Forms – Ultimate Forms Plugin for WordPress up to version 9.2.4. The vulnerability is a generic SQL Injection via the additional_params parameter, due to insufficient escaping and poor query preparation. It is a second‑order issue: a payload is stored via the submis...

CVE-2026-15602

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additionalparams' parameter in all versions up to, and including, 9.2.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2026-19925

A vulnerability was detected in SourceCodester Stock Management System 1.0. This issue affects some unknown processing of the file /classes/Master.php?f=deletesupplier. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit is now public and...

CVE-2026-19926

A vulnerability has been found in Evergreen up to 3.14.11/3.15.11/3.16.5/3.17-beta1. The affected element is an unknown function of the file /osrf-gateway-v1 of the component open-ils.fielder OpenSRF Service. Such manipulation leads to sql injection. The attack can be executed remotely. The explo...

GHSA-H84G-69H7-MW6V vulnerabilities

Vulnerabilities for packages: debezium...

EUVD-2026-59839

A vulnerability has been found in Evergreen up to 3.14.11/3.15.11/3.16.5/3.17-beta1. The affected element is an unknown function of the file /osrf-gateway-v1 of the component open-ils.fielder OpenSRF Service. Such manipulation leads to sql injection. The attack can be executed remotely. The explo...

CVE-2026-19926

CVE-2026-19926 affects Evergreen up to versions 3.14.11/3.15.11/3.16.5/3.17-beta1. The issue lies in an unknown function of the /osrf-gateway-v1 file of the OpenSRF Service (open-ils.fielder), allowing SQL injection through manipulation of that element. The vulnerability can be exploited remotely...

CVE-2026-19926

A vulnerability has been found in Evergreen up to 3.14.11/3.15.11/3.16.5/3.17-beta1. The affected element is an unknown function of the file /osrf-gateway-v1 of the component open-ils.fielder OpenSRF Service. Such manipulation leads to sql injection. The attack can be executed remotely. The explo...

CVE-2026-19926 Evergreen open-ils.fielder OpenSRF Service osrf-gateway-v1 sql injection

A vulnerability has been found in Evergreen up to 3.14.11/3.15.11/3.16.5/3.17-beta1. The affected element is an unknown function of the file /osrf-gateway-v1 of the component open-ils.fielder OpenSRF Service. Such manipulation leads to sql injection. The attack can be executed remotely. The explo...

CVE-2026-19925

CVE-2026-19925 affects SourceCodester Stock Management System 1.0. The vulnerability is a SQL injection in the handling of the argument ID via /classes/Master.php?f=delete_supplier, which may be triggered remotely. The exploitation surface is remote, and public exploits are reported. No specific ...

CVE-2026-19925 SourceCodester Stock Management System Master.php delete_supplier sql injection

A vulnerability was detected in SourceCodester Stock Management System 1.0. This issue affects some unknown processing of the file /classes/Master.php?f=deletesupplier. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit is now public and...

CVE-2026-19925

A vulnerability was detected in SourceCodester Stock Management System 1.0. This issue affects some unknown processing of the file /classes/Master.php?f=deletesupplier. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit is now public and...

EUVD-2026-59838

A vulnerability was detected in SourceCodester Stock Management System 1.0. This issue affects some unknown processing of the file /classes/Master.php?f=deletesupplier. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit is now public and...

CVE-2026-19923

A weakness has been identified in code-projects Online Shopping System 1.0. This affects an unknown part of the file /checkoutprocess.php. Executing a manipulation of the argument totalcount can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the...

EUVD-2026-59809

A vulnerability was found in code-projects Online Shopping System 1.0. This impacts an unknown function of the file /login.php of the component Login. The manipulation of the argument email results in sql injection. The attack may be performed from remote. The exploit has been made public and cou...

EUVD-2026-59810

A vulnerability was determined in code-projects Online Shopping System 1.0. Affected is an unknown function of the file /action.php. This manipulation of the argument proId causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be...

CVE-2026-19923 code-projects Online Shopping System checkout_process.php sql injection

A weakness has been identified in code-projects Online Shopping System 1.0. This affects an unknown part of the file /checkoutprocess.php. Executing a manipulation of the argument totalcount can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the...

CVE-2026-19923 code-projects Online Shopping System checkout_process.php sql injection

A weakness has been identified in code-projects Online Shopping System 1.0. This affects an unknown part of the file /checkoutprocess.php. Executing a manipulation of the argument totalcount can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the...

CVE-2026-19923

A weakness has been identified in code-projects Online Shopping System 1.0. This affects an unknown part of the file /checkoutprocess.php. Executing a manipulation of the argument totalcount can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the...

CVE-2026-19923

Code-projects Online Shopping System 1.0 contains a SQL injection vulnerability in an unknown portion of /checkout_process.php triggered by manipulating the total_count argument. Attack can be launched remotely and the exploit has been publicly released. Exploit maturity is PoC per CVE data; base...