CVE-2026-32479

Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.17 versions...

CVE-2026-32479 WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.17 - SQL Injection vulnerability

Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.17 versions...

CVE-2026-32479 WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.17 - SQL Injection vulnerability

Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.17 versions...

CVE-2026-32479

CVE-2026-32479 is an unauthenticated SQL Injection in the WordPress plugin Visitor Traffic Real Time Statistics Pro , affecting versions ≤ 11.17 . The vulnerability was discovered by Trương Hữu Phúc (Patchstack). The CVSS 3.1 score is 9.3 (Critical) , with a network attack vector, low complexity ...

EUVD-2026-66988

Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.17 versions...

CVE-2026-32479: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.17 versions...

CVE-2026-75798 AI Engine 3.4.0 - 3.7.1 - Unauthenticated Arbitrary AI Query Execution via Editor Assistant

The AI Engine WordPress plugin before 3.7.2 does not perform an authorisation check on one of its administration-only features, relying instead on a token it hands out to anonymous visitors, allowing unauthenticated attackers to run AI queries of their own choosing against the site owner's...

EUVD-2026-65353

The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persisted into the shared rootline cache, allowing anonymous visitors to bypass extendToSubpages-inherited access restrictions on cached pages...

CVE-2026-65644

Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpoint POST /api/v1/livechat/visitor that accepts an unauthenticated, unsanitized name field for Livechat visitors. This name is stored raw and later rendered via...

CVE-2026-65644

Rocket.Chat versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 are vulnerable to a Stored HTML Injection (CWE-79). The POST /api/v1/livechat/visitor REST API endpoint accepts an unauthenticated, unsanitized name field for Livechat visitors. This data is stored raw...

PT-2026-79291

Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpoint POST /api/v1/livechat/visitor that accepts an unauthenticated, unsanitized name field for Livechat visitors. This name is stored raw and later rendered via...

CVE-2026-65644: Improper Neutralization of Input During Web Page Generation

Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpoint POST /api/v1/livechat/visitor that accepts an unauthenticated, unsanitized name field for Livechat visitors. This name is stored raw and later rendered via...

CVE-2026-77019

A vulnerability was determined in CodeAstro Apartment Visitor Management System 1.0. Affected is an unknown function of the file /apartment-visitor/forgotpw.php. Executing a manipulation of the argument secode can lead to sql injection. The attack may be launched remotely. The exploit has been...

CVE-2026-77020 CodeAstro Apartment Visitor Management System password-recovery.php sql injection

A vulnerability was identified in CodeAstro Apartment Visitor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file password-recovery.php. The manipulation of the argument email leads to sql injection. Remote exploitation of the attack is possible. The...

CVE-2026-77019 CodeAstro Apartment Visitor Management System forgotpw.php sql injection

A vulnerability was determined in CodeAstro Apartment Visitor Management System 1.0. Affected is an unknown function of the file /apartment-visitor/forgotpw.php. Executing a manipulation of the argument secode can lead to sql injection. The attack may be launched remotely. The exploit has been...

EUVD-2026-63421

A vulnerability was determined in CodeAstro Apartment Visitor Management System 1.0. Affected is an unknown function of the file /apartment-visitor/forgotpw.php. Executing a manipulation of the argument secode can lead to sql injection. The attack may be launched remotely. The exploit has been...

CVE-2026-77019

CodeAstro Apartment Visitor Management System 1.0 has a SQL injection in /apartment-visitor/forgotpw.php via the secode argument, exploitable remotely without authentication (CVSS 7.5 HIGH). A proof-of-concept exploit is publicly disclosed; no patch version is provided. Exploitation details are n...

PT-2026-79056

A vulnerability was determined in CodeAstro Apartment Visitor Management System 1.0. Affected is an unknown function of the file /apartment-visitor/forgotpw.php. Executing a manipulation of the argument secode can lead to sql injection. The attack may be launched remotely. The exploit has been...

CVE-2026-77019: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in CodeAstro Apartment Visitor Management System 1.0. Affected is an unknown function of the file /apartment-visitor/forgotpw.php. Executing a manipulation of the argument secode can lead to sql injection. The attack may be launched remotely. The exploit has been...

CVE-2026-77020: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in CodeAstro Apartment Visitor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file password-recovery.php. The manipulation of the argument email leads to sql injection. Remote exploitation of the attack is possible. The...