VulnCheck KEV: CVE-2024-5522

The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks...

PT-2026-99694

Name of the Vulnerable Software and Affected Versions CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be Description A remote SQL injection is possible via the myfid argument in the updatedetailsfromfaculty.php file. SQL injection is a technique where an attacker...

CVE-2026-101046: Improper Neutralization of Special Elements used in an SQL Command

Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/id/activities. The deprecated cursor-pagination helper appendListOptionsWithCursorToSQL interpolated the caller-supplied sort/order key into the SQL...

CVE-2026-100739

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file viewresult.php. Performing a manipulation of the argument seno results in sql injection. Remote exploitation of the attack is...

CVE-2026-100739 mathurvishal CloudClassroom-PHP-Project viewresult.php sql injection

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file viewresult.php. Performing a manipulation of the argument seno results in sql injection. Remote exploitation of the attack is...

CVE-2026-100739

A SQL injection vulnerability exists in the mathurvishal CloudClassroom-PHP-Project (up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be). The flaw impacts an unknown function within the viewresult.php file, specifically allowing for exploitation via manipulation of the seno argument. This vuln...

CVE-2026-100739 mathurvishal CloudClassroom-PHP-Project viewresult.php sql injection

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file viewresult.php. Performing a manipulation of the argument seno results in sql injection. Remote exploitation of the attack is...

Exploit for CVE-2026-94130

CVE-2026-94130 — YouTube Gallery for Joomla SQL Injection P...

Exploit for Interpretation Conflict in Wordpress

LANGZ — wp2shell Exploit Tool Author: LANGZ CVE: CV...

aegis-lens

Aegis Lens 🔍🛡️ A browser extension Manifest V3 that turns t...

CVE-2026-97162

Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29...

CVE-2026-97162

The UP plugin (lomart.fr) for Joomla is affected by multiple SQL injection vectors in versions 5.0.0-5.2.0 and 6.0.0-6.0.29 . These vulnerabilities allow an attacker to interfere with the application's database queries, potentially leading to the unauthorized viewing, modification, or deletion of...

EUVD-2026-87779

Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29...

CVE-2026-97162 Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29...

CVE-2026-97162 Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29...

CVE-2026-94130

Joomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gallery extension 5.7.3 - An SQL injection vulnerability in video search functionality and sorting allowed attackers to inject SQL commands in read queries...

CVE-2026-100683

Budibase @budibase/server before 3.45.0 builds MySQL and MSSQL column-rename DDL in packages/backend-core/src/sql/sqlTable.ts by interpolating identifiers directly into a raw query string backtick-quoted for MySQL, a single-quoted sprename literal for MSSQL without applying the project's...

CVE-2026-100644

SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the dailyNoteSavePath parameter is concatenated into SQL without escaping. Unauthenticated attackers on published sites with auth disabled can inject SQL via UNION SELECT to extract arbitrary database ro...

CVE-2026-100627

Capgo Cap-go/capgo.app server backend Supabase functions contain an incorrect authorization flaw in the API-key bundle promotion path. The PUT /bundle endpoint, available to "all" and "write" API keys, dispatches to setChannel, which authorizes with checkPermissionc, 'channel.promotebundle', appI...

UBUNTU-CVE-2026-100695

Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTIONID database result is interpolated into JavaScript without proper escaping, allowing a malicious database server to execute arbitrary JavaScript in the authenticated Adminer origin. In co-located deployments...