CVE-2026-18210

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company Products's Store allows SQL Injection. This issue affects Products's Store: before 030631b2...

EUVD-2026-69142

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company Products's Store allows SQL Injection. This issue affects Products's Store: before 030631b2...

CVE-2026-18210

CVE-2026-18210 is a critical (CVSS 9.8) SQL injection vulnerability in TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company's Products's Store , caused by improper neutralization of special elements in SQL commands. The issue affects versions before commit 03...

CVE-2026-18210 SQL Injection in TRtek Technological Products's Store

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company Products's Store allows SQL Injection. This issue affects Products's Store: before 030631b2...

CVE-2026-17589

The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to generic SQL Injection via the 'productorder' parameter in all versions up to, and including, 5.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...

CVE-2026-17589

The Shopping Cart & eCommerce Store (WP EasyCart) plugin for WordPress is vulnerable to a second-order SQL injection via the product_order parameter in versions up to 5.9.2 . The payload is written to the ec_pageoption table via the ec_ajax_save_page_options handler with no sanitization on raw $_...

EUVD-2026-68970

The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to generic SQL Injection via the 'productorder' parameter in all versions up to, and including, 5.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...

CVE-2026-17589 Shopping Cart & eCommerce Store <= 5.9.2 - Authenticated (Administrator+) SQL Injection via 'product_order' Parameter

The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to generic SQL Injection via the 'productorder' parameter in all versions up to, and including, 5.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...

CVE-2026-81768

Unauthenticated Cross Site Scripting XSS in Super Store Finder = 7.10 versions...

CVE-2026-81768

CVE-2026-81768 is an unauthenticated Cross Site Scripting (XSS) vulnerability in the WordPress plugin Super Store Finder , affecting versions

CVE-2026-81768 WordPress Super Store Finder plugin <= 7.10 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Super Store Finder = 7.10 versions...

EUVD-2026-68790

Unauthenticated Cross Site Scripting XSS in Super Store Finder = 7.10 versions...

CVE-2025-63943

CVE-2025-63943 — Grocery Store Management System 1.0의 SQL 인젝션 개요 Grocery Store Management System 1.0PHP/MySQL 기반 웹 애플리케이션, anirudhkannan 제작의 searchproducts.php 구성 요소에서 높은 심각도의 SQL 인젝션 취약점이 확인되었습니다. 이 문제는 사용자 제어 scost 매개변수를 사용한 부적절한 입력 검증 및 안전하지 않은 SQL 쿼리 구성에서 비롯됩니다. 이 결함으로 인해 공격자는 기본 SQL 로직을 조작할 ...

flowise-arbitrary-file-read-getFileFromStorage

Flowise の未認証任意ファイル読み取り（getFileFromStorage）— 提案中の新規 CVE CVE-2025-71338（ 書き込み シンク）とは別の脆弱性 です。これは、Flowise のドキュメントストアローダー「rehydrate」パスにおける未認証の任意ファイル読み取り であり、影響を受けるのは 1.7.1 – 2.2.3 、2.2.4 で修正されました。/root/.flowise/encryption.key を読み取ると、保存されているすべてのプロバイダー資格情報を復号する鍵が得られます → 資格情報が完全に漏洩します。 目次...

CVE-2026-37149

CVE-2026-37149 SQLインジェクション in GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 概要 CVE ID: CVE-2026-37149 脆弱性タイプ: SQLインジェクション CWE-89 重要度: 高 発見者: Dhyey Patel 説明 GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 には、"/grocery/searchproducts.php" の "scost"...

CVE-2026-20251

CVE-2026-20251 — Splunk Secure Gateway jsonpickle 反序列化远程代码执行 研究员： Fady Oueslati · ReactiveZero Security Research 参考编号： 2026FO-SPLUNK-20251 CVSS： 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 状态： 开放 — 补丁可用 摘要 低权限的已认证用户可以通过在 KV Store（mobilealerts 集合）中存储特制文档，在 Splunk 主机上实现远程代码执行 。Splunk Secure...

CVE-2026-15369

The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.3. This is due to the plugin accepting an attacker-controlled afregselectuserrole value from the unauthenticated WooCommerce Store API...

EUVD-2026-68134

The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.3. This is due to the plugin accepting an attacker-controlled afregselectuserrole value from the unauthenticated WooCommerce Store API...

CVE-2026-15369

Custom User Registration Fields for WooCommerce (WordPress plugin) versions up to 2.2.3 are vulnerable to unauthenticated privilege escalation. The plugin accepts an attacker-controlled afreg_select_user_role value from the unauthenticated WooCommerce Store API /wc/store/v1/checkout endpoint, per...

CVE-2026-15369 Custom User Registration Fields for WooCommerce <= 2.2.3 - Unauthenticated Privilege Escalation via 'afreg_select_user_role' Parameter in Store API Checkout

The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.3. This is due to the plugin accepting an attacker-controlled afregselectuserrole value from the unauthenticated WooCommerce Store API...