287960 matches found
CVE-2026-109414: Improper Neutralization of Special Elements used in an SQL Command
The Vitepos ā Point of Sale POS for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'srcby.val.start / srcby.val.end operator 'bt'' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficien...
CVE-2026-111685: Improper Neutralization of Special Elements used in an SQL Command
IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL by supplying a crafted num path parameter to /WebResource/findresourcebynum. Attackers can append SQL after the LIMIT clause concatenated via QueryWrapper.last to extract databa...
CVE-2026-93953: Improper Neutralization of Special Elements used in an SQL Command
The Backuply ā Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field second-order, via restore in all versions up to, and including, 1.5.8 due to insufficient escaping on the user supplied parameter and the lack of sufficient...
Linux Distros Unpatched Vulnerability : CVE-2026-86047
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW...
CVE-2026-111700: Improper Neutralization of Special Elements used in an SQL Command
WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated user to inject SQL through WHERE-clause text literals in the EQL query API. Attackers can send crafted single-quoted literals to POST /api/v3/enUS/eql, escaping the unsanitized EqlBuilder SQL...
PT-2026-116099
šØ CVE-2026-111700 WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated user to inject SQL through WHERE-clause text literals in the EQL query API. Attackers can send crafted single-quoted literals to POST /api/v3/en US/eql, escaping the unsanitized...
PT-2026-115400
The FluentCart A New Era of eCommerce ā Faster, Lighter, and Simpler plugin for WordPress is vulnerable to generic SQL Injection via the 'products.variants.' parameter in all versions up to, and including, 1.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...
PT-2026-115452
The Vitepos ā Point of Sale POS for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'src by.val.start / src by.val.end operator 'bt'' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of...
PortSwigger-Academy
PortSwigger Web Security Academy ā Writeup & Report Raccolta...
CVE-2026-55871
GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php concatenates the searchname and searchemail GET parameters into both the user-list query and the COUNT query used for pagination without prepare...
CVE-2026-55239
Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, the getDateQuery function in src/server/utils/prisma.ts constructs raw SQL through Prisma.sql by interpolating the timezone request value without parameter binding. The timezone value can reach...
EUVD-2026-102307
GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php concatenates the searchname and searchemail GET parameters into both the user-list query and the COUNT query used for pagination without prepare...
CVE-2026-55871 GYM One: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in admin/users/index.php
GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php concatenates the searchname and searchemail GET parameters into both the user-list query and the COUNT query used for pagination without prepare...
CVE-2026-55871
GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php concatenates the searchname and searchemail GET parameters into both the user-list query and the COUNT query used for pagination without prepare...
CVE-2026-55871
The GYM One gym management software is vulnerable to SQL Injection in the admin/users/index.php component in versions prior to 1.4.1 . The flaw exists because the search_name and search_email GET parameters are concatenated into the user-list and COUNT queries without using prepared statements . ...
CVE-2026-55871 GYM One: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in admin/users/index.php
GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php concatenates the searchname and searchemail GET parameters into both the user-list query and the COUNT query used for pagination without prepare...
CVE-2026-55871 GYM One: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in admin/users/index.php
GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php concatenates the searchname and searchemail GET parameters into both the user-list query and the COUNT query used for pagination without prepare...
WordPress SQL Chart Builder plugin <= 3.0.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability
Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by rwcpower100 in WordPress Plugin SQL Chart Builder versions = 3.0.6...
EUVD-2026-102244
Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, the getDateQuery function in src/server/utils/prisma.ts constructs raw SQL through Prisma.sql by interpolating the timezone request value without parameter binding. The timezone value can reach...
CVE-2026-55239 Tianji: SQL Injection via unsanitized timezone parameter in analytics queries
Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, the getDateQuery function in src/server/utils/prisma.ts constructs raw SQL through Prisma.sql by interpolating the timezone request value without parameter binding. The timezone value can reach...