CVE-2026-109901

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Codepeople CP Multi View Event Calendar cp-multi-view-calendar allows SQL Injection.This issue affects CP Multi View Event Calendar : from n/a through 1.4.41...

CVE-2026-105107

Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/catissuestop.pl script sub calculate concatenates the user-controlled Criteria, Filter, and Limit request parameters directly into dynamic SQL. Criteria is only prefix-normalized and never validated against an...

WordPress Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin <= 1.15.48 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin Form Maker by 10Web versions = 1.15.48...

WordPress JTL-Connector for WooCommerce plugin <= 2.4.3 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Supakiad S. m3ez in WordPress Plugin JTL-Connector for WooCommerce versions = 2.4.3...

CVE-2026-105107 Koha SQL injection in reports/cat_issues_top.pl via the Criteria, Filter and Limit request parameters

Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/catissuestop.pl script sub calculate concatenates the user-controlled Criteria, Filter, and Limit request parameters directly into dynamic SQL. Criteria is only prefix-normalized and never validated against an...

CVE-2026-105107

Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/catissuestop.pl script sub calculate concatenates the user-controlled Criteria, Filter, and Limit request parameters directly into dynamic SQL. Criteria is only prefix-normalized and never validated against an...

CVE-2026-105107

The Koha library system is vulnerable to SQL injection within the reports/cat_issues_top.pl script (specifically the sub calculate function). The root cause is the direct concatenation of user-controlled Criteria , Filter , and Limit request parameters into dynamic SQL queries without adequate va...

CVE-2026-105107 Koha SQL injection in reports/cat_issues_top.pl via the Criteria, Filter and Limit request parameters

Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/catissuestop.pl script sub calculate concatenates the user-controlled Criteria, Filter, and Limit request parameters directly into dynamic SQL. Criteria is only prefix-normalized and never validated against an...

EUVD-2026-100898

Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/catissuestop.pl script sub calculate concatenates the user-controlled Criteria, Filter, and Limit request parameters directly into dynamic SQL. Criteria is only prefix-normalized and never validated against an...

CVE-2026-89310

A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary SQL statements in the context of the application's database account...

CVE-2026-89288

The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database...

CVE-2026-103307

The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it in a SQL statement, and verifies its payment webhook with a signing secret that is empty by default, allowing unauthenticated attackers to perform SQL...

CVE-2026-109901 WordPress CP Multi View Event Calendar plugin <= 1.4.41 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Codepeople CP Multi View Event Calendar cp-multi-view-calendar allows SQL Injection.This issue affects CP Multi View Event Calendar : from n/a through 1.4.41...

CVE-2026-109901

The Codepeople CP Multi View Event Calendar WordPress plugin is vulnerable to SQL Injection (CWE-89) in versions up to and including 1.4.41 . The root cause is the improper neutralization of special elements used in an SQL command, which could allow an attacker to execute arbitrary SQL queries. T...

EUVD-2026-100895

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Codepeople CP Multi View Event Calendar cp-multi-view-calendar allows SQL Injection.This issue affects CP Multi View Event Calendar : from n/a through 1.4.41...

CVE-2026-109901 WordPress CP Multi View Event Calendar plugin <= 1.4.41 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Codepeople CP Multi View Event Calendar cp-multi-view-calendar allows SQL Injection.This issue affects CP Multi View Event Calendar : from n/a through 1.4.41...

WordPress CP Multi View Event Calendar plugin <= 1.4.41 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Peter Tang in WordPress Plugin CP Multi View Event Calendar versions = 1.4.41...

CVE-2026-89310 SQL Command Injection Vulnerability in JTL-WMS

A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary SQL statements in the context of the application's database account...

CVE-2026-89310

A SQL Command Injection vulnerability exists in JTL-WMS (CVE-2026-89310). The flaw occurs because a parameter from the request body is inserted into a T-SQL statement without proper escaping or parameterization. This allows a remote attacker to execute arbitrary SQL commands within the context of...

EUVD-2026-100874

A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary SQL statements in the context of the application's database account...