PT-2026-61522

The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and escape a request parameter before using it in a SQL statement, through an AJAX action available to unauthenticated users, leading to an unauthenticated SQL...

wp2shell

wp2shell WordPress REST batch route-confusion blind SQL injec...

CVE-2026-57832 Joomla Extension - joomdonation.com - Unauthenticated blind SQL injection in EDocman < 3.9

Joomla Extension - joomdonation.com - Unauthenticated blind SQL injection in EDocman 3.9 - The Joomla extension EDocman is vulnerable to an unauthenticated SQL injection...

CVE-2026-57831

Joomla Extension - digital-peak.com - Unauthenticated blind SQL injection in DP Calendar 8.18.0 - 10.11.2 - The Joomla extension DP Calendar is vulnerable to an unauthenticated SQL injection...

Recce server has unauthenticated SQL execution that allows local file read/write through DuckDB

ImpactRecce OSS server deployments that expose the server to an untrusted network without authentication are vulnerable to unauthenticated SQL execution through the query run API.When Recce is configured with a DuckDB-backed project, an attacker can use DuckDB filesystem primitives to read and...

CVE-2026-12582 Library Management System < 3.5.8 - Unauthenticated SQL Injection via book_id

The Library Management System WordPress plugin before 3.5.8 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection and extract arbitrary data from the database, including user password hashes...

ClickHouse Unauthenticated Query Verification

Confirms anonymous ClickHouse HTTP queries via SELECT version and SELECT 1. !/usr/bin/env python3 -- coding: utf-8 -- """Verify unauthenticated ClickHouse SQL queries over HTTP.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from...

PT-2026-56959

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Select-Themes SetSail setsail allows PHP Local File Inclusion.This issue affects SetSail: from n/a through = 2.1...

PT-2026-56948

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in jwsthemes Aqua aqua allows PHP Local File Inclusion.This issue affects Aqua: from n/a through = 5.1.2...

PT-2026-56952

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Elated-Themes Flow flow allows PHP Local File Inclusion.This issue affects Flow: from n/a through = 1.8...

CVE-2026-6230 Tainacan <= 1.0.3 - Unauthenticated SQL Injection via 'geoquery' REST API Parameter

The Tainacan plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'geoquery' parameter in all versions up to and including 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVE-2026-9700

The CVE covers the WordPress Eventer plugin vulnerability up to version 4.4.2, caused by insufficient escaping of the user-supplied code parameter and inadequate SQL query preparation. This enables time-based SQL injection by unauthenticated attackers to append additional SQL to existing queries ...

PT-2026-56514

Name of the Vulnerable Software and Affected Versions IBM API Connect versions 10.0.8.0 through 10.0.8.9 IBM API Connect versions 12.1.0.0 through 12.1.0.3 Description An unauthenticated SQL injection exists in the password reset functionality. SQL injection is a type of vulnerability that allows...

Recce server has unauthenticated SQL execution that allows local file read/write through DuckDB

Impact Recce OSS server deployments that expose the server to an untrusted network without authentication are vulnerable to unauthenticated SQL execution through the query run API. When Recce is configured with a DuckDB-backed project, an attacker can use DuckDB filesystem primitives to read and...

CVE-2026-57683 WordPress WP Fast Total Search plugin <= 1.80.280 - SQL Injection vulnerability

Unauthenticated SQL Injection in WP Fast Total Search = 1.80.280 versions...

CVE-2026-57683

Unauthenticated SQL Injection in WP Fast Total Search = 1.80.280 versions...

EUVD-2026-41292

Unauthenticated SQL Injection in WP Fast Total Search = 1.80.280 versions...

CVE-2026-11823

The CVE-2026-11823 entry concerns the BookingPress Appointment Booking Pro plugin for WordPress, affected up to version 5.7.1. The vulnerability is a SQL Injection via the store_service_date parameter of the bpa_assign_staffmember_to_slots() function. Root cause: user-supplied POST data is passed...

WordPress EventON (Pro) - WordPress Virtual Event Calendar Plugin plugin <= 5.0.11 - WordPress Virtual Event Calendar Plugin <= 5.0.11 - Unauthenticated Blind SQL Injection vulnerability

WordPress EventON Pro - WordPress Virtual Event Calendar Plugin plugin = 5.0.11 - WordPress Virtual Event Calendar Plugin = 5.0.11 - Unauthenticated Blind SQL Injection vulnerability discovered by Nguyen Ngoc Duc duc193 in WordPress Plugin EventON versions = 5.0.11...

SQLAlchemyDA unauthenticated arbitrary SQL query execution

ImpactThe vulnerability allows unauthenticated execution of arbitrary SQL statements on the database the SQLAlchemyDA instance is connected to. All users are affected. PatchesThe problem has been patched in version 2.2. WorkaroundsThere is no workaround. All users are urged to upgrade to version ...