241212 matches found
CVE-2026-66838
Postgrex versions 0.19.3 to 0.22.3 are vulnerable: the :comment option passed to Postgrex.stream/4 is concatenated into the SQL Parse message without escaping, allowing attackers to close the comment delimiter with */ and inject clauses under the connection's role. CISA's SSVC marks exploitation ...
CVE-2026-66838 SQL injection via the :comment option in Postgrex.stream/4
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in elixir-ecto postgrex allows SQL Injection via the :comment option of Postgrex.stream/4. An attacker who can influence that value can close the comment delimiter with / and extend the streamed...
CVE-2026-66838 SQL injection via the :comment option in Postgrex.stream/4
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in elixir-ecto postgrex allows SQL Injection via the :comment option of Postgrex.stream/4. An attacker who can influence that value can close the comment delimiter with / and extend the streamed...
WordPress RealPress plugin <= 1.1.2 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Mukhlis Amien in WordPress Plugin RealPress versions = 1.1.2...
WordPress Active Products Tables for WooCommerce plugin <= 1.1.1 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Asim Alshaya in WordPress Plugin Active Products Tables for WooCommerce versions = 1.1.1...
WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Visitor Traffic Real Time Statistics Pro versions = 11.10...
CVE-2026-19196
A vulnerability was found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the file /social/ajax.php?action=login. The manipulation of the argument email results in sql injection. The attack can be launched remotely. The exploit has been made public and...
CVE-2026-15361
The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJAX actions and does not properly sanitise attacker-supplied data before using it in a SQL query, allowing any authenticated user, including Subscribers, to perform SQL injection attacks...
CVE-2026-15361 Content Views < 4.5 - Subscriber+ SQL Injection via preview_request
The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJAX actions and does not properly sanitise attacker-supplied data before using it in a SQL query, allowing any authenticated user, including Subscribers, to perform SQL injection attacks...
EUVD-2026-54383
The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJAX actions and does not properly sanitise attacker-supplied data before using it in a SQL query, allowing any authenticated user, including Subscribers, to perform SQL injection attacks...
CVE-2026-15361 Content Views < 4.5 - Subscriber+ SQL Injection via preview_request
The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJAX actions and does not properly sanitise attacker-supplied data before using it in a SQL query, allowing any authenticated user, including Subscribers, to perform SQL injection attacks...
CVE-2026-15361
The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJAX actions and does not properly sanitise attacker-supplied data before using it in a SQL query, allowing any authenticated user, including Subscribers, to perform SQL injection attacks...
CVE-2026-19196
CVE-2026-19196 affects SourceCodester Photo Share Website 1.0. The vulnerable element is the unknown function in the file /social/ajax.php?action=login , where manipulation of the email parameter leads to a SQL injection . The attack can be launched remotely and the exploit has been publicly disc...
EUVD-2026-54369
A vulnerability was found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the file /social/ajax.php?action=login. The manipulation of the argument email results in sql injection. The attack can be launched remotely. The exploit has been made public and...
CVE-2026-19196 SourceCodester Photo Share Website ajax.php login sql injection
A vulnerability was found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the file /social/ajax.php?action=login. The manipulation of the argument email results in sql injection. The attack can be launched remotely. The exploit has been made public and...
EUVD-2026-54311
Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an unauthorized attacker to elevate privileges over a network...
EUVD-2026-54308
SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the field and order parameters in paginated list endpoints...
EUVD-2026-54275
Ground Station prior to 0.6.0 contains an unauthenticated database-destruction and arbitrary-data-injection vulnerability in the Socket.IO server's databasebackup event handler that allows any unauthenticated network peer to wipe or replace the entire SQLite database by sending a single fullresto...
EUVD-2026-54228
A weakness has been identified in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /treatmentdetail.php. Executing a manipulation of the argument patientid can lead to sql injection. The attack can be executed remotely. The exploit has been made...