JS Help Desk <= 2.8.2 - SQL Injection

JS Help Desk WordPress plugin 2.8.2 contains a SQL injection caused by insufficient escaping and preparation of user-supplied values in 'js-support-ticket-token-tkstatus' cookie, letting unauthenticated attackers extract sensitive database information, exploit requires no authentication. id:...

CVE-2026-74251

Phoca Cart 中通过属性过滤器的未认证 SQL 注入 Phoca Cart ≤ 6.1.6——未认证攻击者通过时间盲注提取完整数据库 摘要 Phoca Cart 公共商店物品页面上的 a（属性）和 s（规格）GET 数组参数未经参数化或转义，被原样拼接进 SQL WHERE 子句。未认证攻击者可通过这些参数注入任意 SQL，从而利用时间盲注技术提取完整数据库。 该漏洞存在于 admin/libraries/phocacart/search/search.php 中的 getSqlPartsArray 函数。该函数在构建 IN 列表之前调用 explode',',...

Metabase-Exploit

Metabase SQL Injection Zero-Day Exploit GHSA-vwf4-m7j8-wcjf...

CVE-2026-66447

CVE-2026-66447 : Unauthenticated SQL Injection in WordPress File Upload plugin

EUVD-2026-53964

Unauthenticated SQL Injection in Simply Schedule Appointments = 1.6.12.10 versions...

CVE-2026-16065 Welcart e-Commerce < 2.11.32 - Editor+ SQL Injection via CSV Import

The Welcart e-Commerce WordPress plugin before 2.11.32 does not properly sanitise a value taken from an imported CSV file before using it in a SQL statement, allowing users with the Editor role and above including its custom shop-management roles to perform SQL injection attacks...

CVE-2026-11421

The ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support plugin for WordPress is vulnerable to SQL Injection via the 'erpadvancefilter' parameter in all versions up to, and including, 1.17.4 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-69704 Atals-Livre SQL Injection via Unsanitized GET Parameter in supp()

Atals-Livre contains a SQL injection vulnerability that allows attackers to manipulate database queries by passing unsanitized input through a GET parameter to the supp deletion helper function. Attackers can inject malicious SQL syntax via the vulnerable GET parameter to perform unauthorized...

CVE-2026-69084 SiYuan before v3.7.3 SQL Injection via searchEmbedBlock

SiYuan versions = v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan.db handle with no single-statement, read-only, or admin restrictions. The endpoint is gated only by CheckAuth, making it reachable by the...

CVE-2025-69930

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /printmembershipcard.php?id=1...

EUVD-2025-210533

Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in updatestudent.php via parameters fname and studentclass...

EUVD-2025-210535

Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in updatepassword.php via the parameter newpassword...

EUVD-2025-210563

SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in addmeasurement.php?id=1...

CVE-2026-63233

A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment overall answer endpoint, control data passed to unserialize, write a webshell to a publicly accessible location, and execute arbitrary code on the server...

EUVD-2026-50109

The WP Photo Album Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'table' parameter in all versions up to, and including, 9.2.04.002 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2026-11391

CVE-2026-11391 involves a SQL injection vulnerability in Tanium’s Patch module. The connected documents confirm Tanium addressed the vulnerability, with a CVSS v3.1 base score of 6.3 (Network attack vector, Low privileges required, No user interaction; confidentiality, integrity, and availability...

Exploit for SQL Injection in Wordpress

CVE-2026-63030 & CVE-2026-60137 — wp2shell WordPress Cor...

CVE-2026-15663

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to generic SQL Injection via Import File 'settings' Key in all versions up to, and including, 3.14.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

EUVD-2026-48127

Contributor SQL Injection in Visualizer = 4.0.6 versions...

CVE-2016-20096 Linknat VOS3000/VOS2009 2.1.2.0 SQL Injection via login.jsp

Linknat VOS3000 and VOS2009 through version 2.1.2.0 contain an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands by manipulating the name parameter in a POST request to the login endpoint. Attackers can inject malicious SQL through the logi...