288327 matches found
PT-2026-110056
Name of the Vulnerable Software and Affected Versions Recordbrowser WordPress plugin versions prior to 1.1.8 Description An issue exists where the software fails to sanitize and escape the recordid parameter before incorporating it into a SQL query. This allows unauthenticated attackers to perfor...
PT-2026-110025
Name of the Vulnerable Software and Affected Versions Tcard WP versions prior to 1.8.1 Description The plugin fails to sanitize and escape a parameter used in a SQL statement within an unauthenticated AJAX action. This allows unauthenticated users to execute SQL injection attacks, which involve...
PT-2026-110352
A vulnerability has been found in erzhongxmu JEEWMS up to 2026.09.27-W39. The impacted element is the function WvNoticeController.list of the file com/zzjee/wmapi/controller/WvNoticeController.java of the component Search Endpoint. The manipulation of the argument searchstr leads to sql injection...
PT-2026-110057
Name of the Vulnerable Software and Affected Versions WP-Partner versions prior to 1.2.2 Description An issue exists where the software fails to sanitize and escape the id parameter before incorporating it into a SQL query. This allows unauthenticated attackers to perform SQL injection, enabling...
PT-2026-110060
Name of the Vulnerable Software and Affected Versions ASPL Product Quotation versions prior to 1.1.1 Description An issue exists where the software fails to sanitize and escape the quote id parameter before incorporating it into SQL statements. This allows unauthenticated attackers to execute SQL...
PT-2026-110062
Name of the Vulnerable Software and Affected Versions WP Verify API versions prior to 1.0.1 Description Unauthenticated users can perform SQL injection attacks because the plugin fails to properly sanitize and escape the verify parameter before incorporating it into a SQL query. SQL injection is ...
CVE-2026-108690: Operator Precedence Logic Error
mall4j through 4.0 contains an information disclosure vulnerability that allows authenticated customers to read other shoppers' cart items due to an operator precedence error in the getShopCartExpiryItems SQL filter. Attackers with any storefront account can request GET /p/shopCart/expiryProdList...
CVE-2026-108541: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in highwarden Super Store Finder up to 3.8. Affected is an unknown function of the file /products/superstorefinder/index.php. The manipulation of the argument lat/lng leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclos...
CVE-2026-81420: Improper Neutralization of Special Elements used in an SQL Command
The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it in a SQL statement in one of its unauthenticated AJAX actions, allowing unauthenticated users to perform SQL injection attacks...
CVE-2026-89299: Improper Neutralization of Special Elements used in an SQL Command
The WP Verify API WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...
CVE-2026-89302: Improper Neutralization of Special Elements used in an SQL Command
The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...
CVE-2026-89304: Improper Neutralization of Special Elements used in an SQL Command
The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform blind SQL injection attacks...
CVE-2026-89285: Improper Neutralization of Special Elements used in an SQL Command
The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several request parameters before using them to build a SQL query, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database...
CVE-2026-89234: Improper Neutralization of Special Elements used in an SQL Command
The WP-Partner WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database...
CVE-2026-103695: Improper Neutralization of Special Elements used in an SQL Command
The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks...
PT-2026-110350
Name of the Vulnerable Software and Affected Versions erzhongxmu JEEWMS versions prior to 2026.09.27-W39 Description A remote SQL injection is possible through the manipulation of the goodscode argument within the docheck function of the...
Exploit for CVE-2026-102428
CVE-2026-102428 — OrdaSoft OS CCK comoscck unauthenticated...
CVE-2026-62117
Subscriber SQL Injection in Barcode Scanner with Inventory & Order Manager = 1.13.1 versions...