Export limit exceeded: 424542 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (21693 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-12983 | 1 Wordpress-extensions | 1 Dinatur | 2026-11-11 | 8.6 High |
| The Dinatur WordPress plugin through 1.18 does not sanitize and escape user input before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks. The same handler also performs a database table truncation without any authorization check, allowing any unauthenticated visitor to wipe the Dinatur WordPress plugin through 1.18's data. | ||||
| CVE-2026-16950 | 1 Wordpress-extensions | 1 Product Shortlist | 2026-11-11 | 8.6 High |
| The Product Shortlist WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks. | ||||
| CVE-2026-12110 | 2 Taskbuilder, Wordpress-extensions | 2 Taskbuilder, Taskbuilder | 2026-11-11 | 6.5 Medium |
| The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to generic SQL Injection via the 'task_search' parameter in all versions up to, and including, 5.0.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The wppm_get_task_list AJAX handler performs no capability check and no nonce verification, meaning any authenticated user including those with Subscriber-level access can invoke it directly. | ||||
| CVE-2026-12090 | 2 Taskbuilder, Wordpress-extensions | 2 Taskbuilder, Taskbuilder | 2026-11-11 | 6.5 Medium |
| The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to generic SQL Injection via the 'wppm_proj_filter' parameter in all versions up to, and including, 5.0.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. No nonce verification is performed on the wp_ajax_wppm_view_project_tasks handler, meaning any authenticated session — including subscriber-level — can reach the vulnerable code path without any additional preconditions. | ||||
| CVE-2026-118420 | 2026-11-11 | 6.8 Medium | ||
| The WP Directory Kit WordPress plugin before 1.6.3 does not sanitise and escape a parameter before using it in a SQL statement, making it possible for users holding the WP Directory Kit WordPress plugin before 1.6.3's custom Listing Admin role, and above, to perform SQL injection attacks. | ||||
| CVE-2026-12965 | 1 Wordpress-extensions | 1 Super Store Finder | 2026-11-11 | 9.1 Critical |
| The Super Store Finder WordPress plugin before 7.11 does not sanitize a parameter of an unauthenticated AJAX action before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection and extract data from the database. | ||||
| CVE-2026-3430 | 1 Wordpress-extensions | 1 Creative Mail | 2026-11-11 | 8.6 High |
| The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated SQL injection when the abandoned cart email is managed by creative mail. | ||||
| CVE-2026-17044 | 1 Wordpress-extensions | 1 Wordpress File Upload | 2026-11-11 | 8.6 High |
| The Iptanus File Upload WordPress plugin before 5.1.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by unauthenticated users. | ||||
| CVE-2026-17017 | 1 Wordpress-extensions | 1 Cubewp Framework | 2026-11-11 | 8.1 High |
| The CubeWP Framework WordPress plugin before 1.1.31 does not properly sanitize and escape a parameter before using it in a SQL statement through an AJAX action, and does not include a capability check on that action, allowing users with Subscriber-level access and above to perform SQL injection attacks. | ||||
| CVE-2026-13596 | 1 Wordpress-extensions | 1 Participants Database | 2026-11-11 | 9.1 Critical |
| The Participants Database WordPress plugin before 2.7.8.4 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks. | ||||
| CVE-2026-126617 | 2026-11-11 | 8.8 High | ||
| SQL injection in the database layer of Progressive Robot hMailServer 6.0.0-B1 through 6.2.18, when the server uses MySQL/MariaDB or PostgreSQL, allows a remote attacker to alter SQL statements the server runs. On those two engines parameters are not bound: SQLStatement::GenerateFromCommand wrote each value into the statement's text as a quoted literal with a separate string replacement over the whole text per parameter, so a value holding the name of a parameter substituted after it had that name replaced, inside the value, by the later value with its own quotes, which ended the literal early and placed the later value in the statement as SQL. The row the server writes for each recipient of a queued message carries the recipient's address twice, so in the default configuration an authenticated user who may send mail reaches it by sending to an address of their choosing. A remote unauthenticated sender reaches the same statement through a message the server sends to the envelope sender, such as a delivery failure notice or an automatic reply, and, when greylisting or message indexing is enabled (both are off by default), through the greylisting record's envelope addresses or through the message metadata the server stores for IMAP SORT, which carries four header fields of a received message. An altered statement runs with the privileges of the server's database account; on PostgreSQL, whose client call runs every statement in the text it is given, further statements can follow it, while on MySQL/MariaDB, where one statement is run per call, the change is confined to the statement it is in. SQL Server and SQL Server Compact, where parameters are bound, are not affected. | ||||
| CVE-2026-12062 | 1 Zohocorp | 1 Adaudit Plus | 2026-11-11 | 8.8 High |
| Zoho Corporation ManageEngine ADAudit Plus versions below 8703 are vulnerable to an authenticated SQL injection vulnerability in ADAudit Plus Reports API. | ||||
| CVE-2026-76981 | 1 Zohocorp | 1 Adaudit Plus | 2026-11-11 | 8.8 High |
| Zoho Corporation ManageEngine ADAudit Plus versions below 8711 are vulnerable to an authenticated second order SQL injection vulnerability affecting ADAudit Plus custom reports module. | ||||
| CVE-2026-18912 | 1 Zohocorp | 2 Datasecurity Plus, Manageengine Datasecurity Plus | 2026-11-11 | 8.1 High |
| Zoho Corporation ManageEngine DataSecurity Plus versions below 6310 are vulnerable to an authenticated SQL injection vulnerability in reports module where an authenticated technician could execute arbitrary SQL queries. | ||||
| CVE-2026-116645 | 1 Limesurvey | 1 Limesurvey Community Edition | 2026-11-11 | N/A |
| LimeSurvey Community Edition 7.8.0 contains an SQL injection vulnerability in the survey-archive participant import and SPSS-response export workflow. An authenticated user with global surveys.create permission can import a crafted .lsa archive whose participant XML creates an attacker-named attribute column. When the user exports responses from the imported non-anonymous survey, LimeSurvey passes the persisted name to Yii's select builder. Names containing parentheses are treated as SQL expressions instead of quoted identifiers, causing attacker-controlled SQL to execute with the application's database privileges. | ||||
| CVE-2026-63192 | 2026-11-11 | N/A | ||
| OpenMRS module bahmnicore contains Core OpenMRS modules for Bahmni (including ERP & ELIS Atom Feed Clients). In version 0.93, an attacker with authenticated access could potentially exfiltrate sensitive data from the database. This issue has been patched in version 0.93.1. | ||||
| CVE-2026-66447 | 2 Nickboss, Wordpress-extensions | 2 Wordpress File Upload, Wordpress File Upload | 2026-11-10 | 9.3 Critical |
| Unauthenticated SQL Injection in WordPress File Upload <= 5.1.7 versions. | ||||
| CVE-2026-37009 | 2 Crewai, Crewaiinc | 2 Crewai-tools, Crewai-tools | 2026-11-10 | 6.5 Medium |
| A SQL injection vulnerability in NL2SQLTool in crewai-tools v1.10.2rc1 allows a remote attacker to execute arbitrary SQL commands via an unsanitized sql_query argument. | ||||
| CVE-2024-58385 | 1 Yonyou | 1 U8 Crm | 2026-11-10 | 9.8 Critical |
| Yonyou U8 CRM contains an unauthenticated SQL injection vulnerability in the fillbacksettingedit.php configuration endpoint where the DontCheckLogin=1 parameter bypasses authentication and the id parameter is incorporated into SQL queries without sanitization. Attackers can exploit this flaw to execute arbitrary SQL commands and, on Microsoft SQL Server deployments with xp_cmdshell enabled, write backdoor files and execute arbitrary operating system commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-02-13. | ||||
| CVE-2026-97287 | 2 Nexcess, Wordpress-extensions | 2 Event Tickets, Event Tickets | 2026-11-10 | 8.5 High |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Blind SQL Injection. This issue affects Event Tickets: from n/a through 5.29.5. | ||||