CVE-2026-108690 mall4j through 4.0 Operator Precedence Error Exposes Other Users' Cart Items via /p/shopCart/expiryProdList

mall4j through 4.0 contains an information disclosure vulnerability that allows authenticated customers to read other shoppers' cart items due to an operator precedence error in the getShopCartExpiryItems SQL filter. Attackers with any storefront account can request GET /p/shopCart/expiryProdList...

EUVD-2026-96711

mall4j through 4.0 contains an information disclosure vulnerability that allows authenticated customers to read other shoppers' cart items due to an operator precedence error in the getShopCartExpiryItems SQL filter. Attackers with any storefront account can request GET /p/shopCart/expiryProdList...

CVE-2026-108690

Versions of mall4j through 4.0 are vulnerable to an information disclosure flaw caused by an operator precedence error in the getShopCartExpiryItems SQL filter. An authenticated attacker with any storefront account can access the GET /p/shopCart/expiryProdList endpoint to view other users' shoppi...

PT-2026-110103

Name of the Vulnerable Software and Affected Versions Xinhu Rainrock RockOA versions prior to 2.7.7 Description A remote SQL injection exists within the Openkqj Action component. The issue occurs in the kqjcmdModel::returnchuli function located in the webmain/task/openapi/openkqjAction.php file. ...

PT-2026-110054

Name of the Vulnerable Software and Affected Versions Llavero.io versions prior to 0.1.5 Description An issue exists where the software fails to properly sanitize and escape the cill login parameter before incorporating it into a SQL statement. This allows unauthenticated attackers to execute SQL...

OrdaSoft Joomla CCK 8.3.15 SQL Injection

OrdaSoft Joomla CCK versions through 8.3.15 contain an unauthenticated SQL injection in record sorting. The supplied proof of concept discovers public listing routes and demonstrates error-based extraction through user-controlled order parameters. https://packetstorm.news/download/235115...

CVE-2026-89213: Improper Neutralization of Special Elements used in an SQL Command

The Llavero.io WordPress plugin through 0.1.4 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database...

PT-2026-110354

Name of the Vulnerable Software and Affected Versions erzhongxmu JEEWMS versions prior to 2026.09.27-W39 Description A remote SQL injection issue exists within the Inbound Quality Check Pda Interface component. The flaw is located in the WmInQmIController.list function within the...

PT-2026-110101

A vulnerability was identified in Furion .NET Framework up to 4.9.9.92. The impacted element is the function String.Replace of the file framework/Furion/Templates/Extensions/StringRenderExtensions.cs. The manipulation of the argument Name leads to sql injection. Remote exploitation of the attack ...

CVE-2026-89195: Improper Neutralization of Special Elements used in an SQL Command

The Site Setup Wizard WordPress plugin through 1.5.8 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database...

CVE-2026-89305: Improper Neutralization of Special Elements used in an SQL Command

The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to perform SQL injection attacks...

CVE-2026-108569: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in Furion .NET Framework up to 4.9.9.92. The impacted element is the function String.Replace of the file framework/Furion/Templates/Extensions/StringRenderExtensions.cs. The manipulation of the argument Name leads to sql injection. Remote exploitation of the attack ...

PT-2026-110059

Name of the Vulnerable Software and Affected Versions Datalist it versions prior to 0.0.4 Description The Datalist it WordPress plugin fails to sanitize and escape several request parameters used in the construction of SQL queries. This allows unauthenticated attackers to execute SQL injection...

PT-2026-110052

Name of the Vulnerable Software and Affected Versions Social Web Suite versions prior to 4.1.13 Description The Social Web Suite WordPress plugin fails to require a shared secret before accepting authorized requests. Additionally, it does not sanitize or escape a parameter used in an SQL statemen...

CVE-2026-89214: Improper Neutralization of Special Elements used in an SQL Command

The WpCues Basic Quiz WordPress plugin through 1.6.5 does not properly sanitise and escape values before using them in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database...

PT-2026-110055

Name of the Vulnerable Software and Affected Versions WpCues Basic Quiz versions prior to 1.6.6 Description The plugin fails to properly sanitize and escape values before incorporating them into a SQL statement. This allows unauthenticated attackers to execute SQL injection attacks, which is a...

PT-2026-110010

Name of the Vulnerable Software and Affected Versions Mobile builder WordPress plugin versions prior to 1.4.3 Description Unauthenticated users can perform SQL injection attacks because the plugin fails to sanitize and escape a parameter before incorporating it into a SQL statement. SQL injection...

PT-2026-110187

Name of the Vulnerable Software and Affected Versions erzhongxmu Jeewms versions prior to 3.7 Description A remote SQL injection issue exists within the Autocomplete Data Handler component. The flaw is located in the getTreeData function of the...

PT-2026-110071

Name of the Vulnerable Software and Affected Versions highwarden Super Store Finder versions prior to 3.9 Description An issue exists in the /products/superstorefinder/index.php file where manipulation of the lat/lng argument allows for SQL injection, a technique used to interfere with the querie...

PT-2026-110053

Name of the Vulnerable Software and Affected Versions Site Setup Wizard versions prior to 1.5.9 Description An issue exists where the plugin fails to properly sanitize and escape a parameter before incorporating it into a SQL statement. This allows unauthenticated attackers to execute SQL injecti...