K000162749: PostgreSQL vulnerability CVE-2026-6638

Security Advisory Description SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table creator to execute arbitrary SQL with the subscription's publication-side credentials. The attack takes effect at the next REFRESH PUBLICATION. Within...

wp2shell-Hestia-Scanner — Updated!

🛡️ wp2shell-Hestia-Scanner 🇬🇧 English | 🇬🇷 Ελληνικά Read-only WordPress security scanner for HestiaCP servers. Detects wp2shell compromise indicators across all hosted sites — with per-client email reports, core file diff, SHA256 webshell detection, risk scoring, and optional AI evaluation. ⚠️ Safe...

WordPress WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars plugin <= 3.9.1 - Authenticated (Author+) SQL Injection vulnerability

Authenticated Author+ SQL Injection vulnerability discovered by Ryoma Nishioka in WordPress Plugin WP Post Author versions = 3.9.1...

CVE-2026-69704

CVE-2026-69704 affects Atals-Livre and describes a SQL injection vulnerability in the supp() deletion helper function where unsanitized input passed via a GET parameter is used to manipulate database queries. The vulnerability enables attackers to craft input to perform unauthorized database oper...

EUVD-2026-52868

Atals-Livre contains a SQL injection vulnerability that allows attackers to manipulate database queries by passing unsanitized input through a GET parameter to the supp deletion helper function. Attackers can inject malicious SQL syntax via the vulnerable GET parameter to perform unauthorized...

CVE-2026-69704 Atals-Livre SQL Injection via Unsanitized GET Parameter in supp()

Atals-Livre contains a SQL injection vulnerability that allows attackers to manipulate database queries by passing unsanitized input through a GET parameter to the supp deletion helper function. Attackers can inject malicious SQL syntax via the vulnerable GET parameter to perform unauthorized...

WordPress WP TripAdvisor Review Slider plugin <= 14.3 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by yuyudhn in WordPress Plugin WP TripAdvisor Review Slider versions = 14.3...

WordPress Askeet — Talk to Your WooCommerce Data plugin <= 3.0 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Régis SENET in WordPress Plugin Askeet versions = 3.0...

WordPress PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links plugin <= 3.6.20 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Michael Iden Mickhat in WordPress Plugin Shortlinks by Pretty Links versions = 3.6.20...

postgresql: PostgreSQL: Arbitrary code execution vulnerability in 'refint' module

A flaw was found in PostgreSQL. A stack buffer overflow in the 'refint' module allows an unprivileged database user to execute arbitrary code as the operating system user running the database. Additionally, a separate vulnerability exists where, if an application uses a user-controlled column as ...

WordPress Relevanssi Premium – A Better Search plugin <= 2.30.2 - Authenticated (Contributor+) SQL Injection vulnerability

Authenticated Contributor+ SQL Injection vulnerability discovered by daroo in WordPress Plugin Relevanssi Premium versions = 2.30.2...

WordPress ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin <= 1.17.4 - Authenticated (Custom+) SQL Injection vulnerability

Authenticated Custom+ SQL Injection vulnerability discovered by Hyunsoo Jeong in WordPress Plugin WP ERP versions = 1.17.4...

CVE-2026-18801

OpenMeter contains a stored, or second-order, SQL injection vulnerability in the handling of customer usage-attribution values. An attacker who can create or update a customer can store a malicious value in the usageAttribution.key or usageAttribution.subjectKeys fields. When that customer is...

Flowise RCE via SQLite Record Manager Node

============================================================================= Security Advisory elttam Topic: Flowise RCE via SQLite Record Manager Node Module: FlowiseAI/Flowise Disclosed: 24-Apr-2026 Credits: Alex Brown Affects: FlowiseAI/Flowise 3.1.2 I. Background Flowise AI is an open-source...

CVE-2026-64631

A vulnerability allowing a low-privileged user to inject SQL and extract database contents...

CVE-2026-64631

CVE-2026-64631 describes an SQL injection vulnerability exploitable by a low-privilege user that can extract database contents. According to the provided metrics, the vulnerability has HIGH base severity (CVSS 4.0, score 8.5) with network attack vector, low attack complexity, and no user interact...

Malicious code in @servicetitan/admin-sql-table (npm)

npm/@servicetitan/admin-sql-table is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

K000162772: Drupal vulnerability CVE-2026-9082

Security Advisory Description Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0...

CVE-2026-18766

A flaw has been found in chetans9 core-php-admin-panel up to 90d07ed5aac5e0f09b6a5828d7bb2eb83010763f. This issue affects some unknown processing of the file /Applications/MAMP/htdocs/core-php-admin-panel-master/customers.php. Executing a manipulation of the argument filtercol can lead to sql...

CVE-2026-18801 Stored Clickhouse SQL Injection Through Customer Usage Attribution

OpenMeter contains a stored, or second-order, SQL injection vulnerability in the handling of customer usage-attribution values. An attacker who can create or update a customer can store a malicious value in the usageAttribution.key or usageAttribution.subjectKeys fields. When that customer is...