Export limit exceeded: 417456 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 54178 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 21524 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (21524 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-104667 | 1 Wordpress-extensions | 1 Animated Number Counters | 2026-10-09 | 6.8 Medium |
| The Animated Number Counters WordPress plugin before 3.1 does not sanitise or escape a value stored by an Editor-level user before concatenating it into a SQL query that runs when any unauthenticated visitor renders a page containing the counter, leading to second-order SQL injection that can read arbitrary data including password hashes. | ||||
| CVE-2026-104953 | 1 Wordpress-extensions | 1 Mpg | 2026-10-09 | 6.8 Medium |
| The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users with the Editor role or higher to perform SQL injection attacks and read sensitive data such as password hashes. | ||||
| CVE-2026-102782 | 1 Ordasoft.com | 1 Ordasoft Simple Membership Extension For Joomla | 2026-10-09 | N/A |
| Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0 - site/simplemembership.php dispatches task=checkLoginPass with no authentication or access control check of any kind. The handler reads a login request parameter through Joomla’s generic, non-sanitizing input filter, which strips HTML/script tags but never touches quotes or SQL syntax, and concatenates it directly into a query string with no escaping or parameterization: | ||||
| CVE-2026-42721 | 2 Servit Software Solutions, Wordpress-extensions | 2 Affiliate-toolkit, Affiliate-toolkit | 2026-10-09 | 7.6 High |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SERVIT Software Solutions affiliate-toolkit affiliate-toolkit-starter allows Blind SQL Injection.This issue affects affiliate-toolkit: from n/a through 3.9.1. | ||||
| CVE-2026-42720 | 2 Sarah Giles, Wordpress-extensions | 2 Dynamic User Directory, Dynamic User Directory | 2026-10-09 | 7.6 High |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sarah Giles Dynamic User Directory dynamic-user-directory allows Blind SQL Injection.This issue affects Dynamic User Directory: from n/a through 2.4. | ||||
| CVE-2026-103668 | 1 Six Apart | 4 Movable Type, Movable Type Cloud Edition, Movable Type Premium and 1 more | 2026-10-09 | N/A |
| An SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary SQL query on the affected product. | ||||
| CVE-2026-42714 | 2 Piggly Dev, Wordpress-extensions | 2 Pix Por Piggly (para Woocommerce), Pix Por Piggly (para Woocommerce) | 2026-10-09 | 7.6 High |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Piggly Dev Pix por Piggly (para Woocommerce) pix-por-piggly allows Blind SQL Injection.This issue affects Pix por Piggly (para Woocommerce): from n/a through 2.1.2. | ||||
| CVE-2026-42713 | 2 Gopiplus, Wordpress-extensions | 2 Post Title Marquee Scroll, Post Title Marquee Scroll | 2026-10-09 | 7.6 High |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Gopiplus Post title marquee scroll post-title-marquee-scroll allows Blind SQL Injection.This issue affects Post title marquee scroll: from n/a through 9.9. | ||||
| CVE-2026-42710 | 2 10web, Wordpress-extensions | 2 Sliderby10web, Slider By 10web | 2026-10-09 | 7.6 High |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 10Web Slider by 10Web slider-wd allows Blind SQL Injection.This issue affects Slider by 10Web: from n/a through 1.2.63. | ||||
| CVE-2026-42708 | 2 Afthemes, Wordpress-extensions | 2 Wp Post Author, Wp Post Author | 2026-10-09 | 7.6 High |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AF themes WP Post Author wp-post-author allows Blind SQL Injection.This issue affects WP Post Author: from n/a through 4.0.0. | ||||
| CVE-2026-62251 | 1 Sipcapture | 1 Homer | 2026-10-09 | 8.1 High |
| Homer is open source telecom observability software. Prior to version 11.0.283, the `V4StatisticsQuery` handler passes the user-supplied `rawquery` field directly to DuckDB without calling the `sqlvalidator.ValidateRawSQL` function used throughout the rest of the codebase. Any authenticated user can execute arbitrary SQL statements against all data accessible through the FlightSQL service. Version 11.0.283 patches the issue. | ||||
| CVE-2026-76452 | 1 Cisco | 1 Cisco License On-prem | 2026-10-09 | 4.9 Medium |
| A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an authenticated, remote attacker to conduct SQL injection attacks against an affected application. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to read additional contents of the internal database of an affected application that should not normally be accessible to administrative users, thus impacting system confidentiality. To exploit this vulnerability, the attacker must have valid administrative user credentials on the affected application. | ||||
| CVE-2026-95605 | 2 Passionate Programmer Peter, Wordpress-extensions | 2 Wp Data Access, Wp Data Access | 2026-10-09 | 9.3 Critical |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Passionate Programmer Peter WP Data Access allows Blind SQL Injection. This issue affects WP Data Access: from n/a through 5.5.82. | ||||
| CVE-2026-105957 | 1 Sourcecodester | 1 Performance Indicator System | 2026-10-09 | 6.3 Medium |
| A vulnerability was detected in SourceCodester Performance Indicator System 1.0. The affected element is an unknown function of the file /opils/admin/view_product.php. Performing a manipulation of the argument Category results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. | ||||
| CVE-2026-105920 | 1 Kusalkasilva | 1 Learning-management-system | 2026-10-09 | 7.3 High |
| A vulnerability was determined in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The impacted element is an unknown function of the file student_signup.php of the component Student Registration Endpoint. This manipulation causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-67100 | 1 Hcltech | 1 Bigfix Service Management | 2026-10-08 | 9.8 Critical |
| HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities. which could allow an authenticated attacker to inject database commands to extract sensitive system details, as well as manipulate request values to gain unauthorized access to full personal profile data and PII across different organizations. | ||||
| CVE-2026-105076 | 2026-10-08 | 7.6 High | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Appsbd Vitepos vitepos-lite allows Blind SQL Injection.This issue affects Vitepos: from n/a through 3.6.1. | ||||
| CVE-2026-72851 | 1 Budibase | 2 Budibase, Server | 2026-10-08 | 10 Critical |
| Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTE_QUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials, enabling data exfiltration, modification, and persistence in connected datasources like Snowflake. | ||||
| CVE-2026-102109 | 2 Accellion, Kiteworks | 2 Kiteworks, Secure Data Forms | 2026-10-08 | 7.1 High |
| A SQL injection vulnerability existed in Kiteworks Secure Data Forms, where a value derived from the authenticated user's stored account data was incorporated into a database query without proper sanitization. An authenticated user could potentially influence that value to inject SQL. Exploitation requires an authenticated session and applies only to deployments where a specific optional feature is in use. | ||||
| CVE-2026-12260 | 1 Netboard Crm | 1 Netboard Crm Demo Platform | 2026-10-08 | N/A |
| SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable to blind attacks based on Boolean, error, time-based and UNION techniques. Exploitation allows attackers to extract confidential information (such as the version and type of backend used), alter data or further compromise the CRM environment. | ||||