CVE-2024-58393

i-Netsolution Readymade Unilevel Ecommerce MLM 2024-03-15 build contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries through the 'id' parameter. Attackers can send GET requests to /product-details.php with boolean-based, stacked, or time-bas...

CVE-2022-51021

NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by supplying an array-form 'id' parameter to /wp-json/notificationx/v1/notification/id. Attackers can pass id1 with crafted SQ...

CVE-2019-25778

SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist array parameter. Attackers can send GET requests to /comment/api/index.php with crafted rlist values using backtick-quoted...

CVE-2019-25778

SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist array parameter. Attackers can send GET requests to /comment/api/index.php with crafted rlist values using backtick-quoted...

CVE-2026-112822 WordPress Workreap Core plugin < 3.4.4 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in AmentoTech Workreap Core workreapcore allows Blind SQL Injection.This issue affects Workreap Core: from n/a before 3.4.4...

EUVD-2026-108137

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in AmentoTech Workreap Core workreapcore allows Blind SQL Injection.This issue affects Workreap Core: from n/a before 3.4.4...

CVE-2026-112822 WordPress Workreap Core plugin < 3.4.4 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in AmentoTech Workreap Core workreapcore allows Blind SQL Injection.This issue affects Workreap Core: from n/a before 3.4.4...

CVE-2026-112822

The AmentoTech Workreap Core WordPress plugin is vulnerable to a Blind SQL Injection flaw due to the improper neutralization of special elements used in SQL commands. This issue affects versions prior to 3.4.4 . An attacker could potentially exploit this to interact with the underlying database. ...

EUVD-2026-108134

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscriptionfilterkeys that bypass keyword-only validation. Attackers can create subscriptions using the malicious key, which is rendered as an unquoted...

EUVD-2026-108133

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric propertyname or categorical filter values. Attackers can embed SQL in values rendered unescaped into Jinja-generated counter, gauge and rate...

CVE-2026-115332

Lotus versions through 0.10.2 are vulnerable to an SQL injection vulnerability. Authenticated organization users can bypass keyword-only validation by registering crafted subscription_filter_keys . These malicious keys are rendered as unquoted group-by identifiers, allowing attackers to inject SQ...

CVE-2026-115331 Lotus through 0.10.2 SQL Injection via Metric Property Names and Filters

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric propertyname or categorical filter values. Attackers can embed SQL in values rendered unescaped into Jinja-generated counter, gauge and rate...

CVE-2026-115332 Lotus through 0.10.2 SQL Injection via Subscription Filter Keys

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscriptionfilterkeys that bypass keyword-only validation. Attackers can create subscriptions using the malicious key, which is rendered as an unquoted...

CVE-2026-115331 Lotus through 0.10.2 SQL Injection via Metric Property Names and Filters

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric propertyname or categorical filter values. Attackers can embed SQL in values rendered unescaped into Jinja-generated counter, gauge and rate...

CVE-2026-115332 Lotus through 0.10.2 SQL Injection via Subscription Filter Keys

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscriptionfilterkeys that bypass keyword-only validation. Attackers can create subscriptions using the malicious key, which is rendered as an unquoted...

CVE-2026-115331

The Lotus software (through version 0.10.2 ) is vulnerable to an SQL injection vulnerability. Authenticated organization users can inject SQL by providing crafted billable metric property_name or categorical filter values. These values are rendered unescaped into Jinja-generated counter, gauge, a...

CVE-2026-115330 Lotus through 0.10.2 SQL Injection via Custom SQL Billable Metrics

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only...

CVE-2026-115330

Lotus versions up to and including 0.10.2 are vulnerable to an SQL injection vulnerability. Authenticated organization users can execute arbitrary SQL by submitting semicolon-separated stacked statements via POST /app/metrics/ . This method bypasses first-statement-only validation, potentially al...

EUVD-2026-108132

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only...

CVE-2026-115330 Lotus through 0.10.2 SQL Injection via Custom SQL Billable Metrics

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only...