CVE-2026-92766 | High | 7.5 | 2026-10-16 | The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'src_by' parameter in all versions up to… |
CVE-2026-111472 | | | 2026-10-16 | An SQL injection vulnerability has been discovered in TSG Profleet. The vulnerability could allow an attacker to retrieve, create, update and delete data from… |
CVE-2026-94388 | Critical | 9.3 | 2026-10-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in halfdata Green Popups halfdata-green-popups allows Blind… |
CVE-2026-111178 | Medium | 4.9 | 2026-10-16 | The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to generic SQL Injection via the 'data[orderby]' parameter in all versions up to, a… |
CVE-2026-109414 | Medium | 6.5 | 2026-10-16 | The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'src_by[].val.start / src_by[].val.end (ope… |
CVE-2026-111106 | Medium | 6.5 | 2026-10-16 | The Mail Mint plugin for WordPress is vulnerable to SQL Injection via the 'filters' parameter of the /wp-json/mrm/v1/segments/contacts REST endpoint in version… |
CVE-2026-93953 | High | 8.0 | 2026-10-16 | The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field (second-order, via restor… |
CVE-2026-111444 | Critical | 9.8 | 2026-10-16 | Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request d… |
CVE-2026-103518 | Medium | 4.9 | 2026-10-16 | The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to generic SQL Injection via the 'products[*].variants[… |
CVE-2026-111389 | High | 7.7 | 2026-10-16 | Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input… |
CVE-2026-55871 | Medium | 6.5 | 2026-10-15 | GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php concat… |
CVE-2026-55239 | High | 8.8 | 2026-10-15 | Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, the getDateQuery() function in src/server/utils/prisma.ts… |
CVE-2026-53574 | High | 7.6 | 2026-10-15 | EspoCRM is an open source customer relationship management application. From 8.1.0 until 9.3.8, an authenticated non-administrator can submit a crafted where p… |
CVE-2026-109698 | Critical | 9.3 | 2026-10-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kitae Park Mang Board WP mangboard allows SQL Injection.T… |
CVE-2026-109688 | Critical | 9.3 | 2026-10-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Bl… |
CVE-2026-108497 | Critical | 9.3 | 2026-10-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue… |
CVE-2026-26245 | | | 2026-10-15 | A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to… |
CVE-2026-26244 | | | 2026-10-15 | A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to… |
CVE-2026-63314 | | | 2026-10-15 | WebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection in /webcti/admin_json.php enpoint. Improper neutralization of input allows an… |
CVE-2026-15090 | High | 7.5 | 2026-10-15 | The Link Library plugin for WordPress is vulnerable to time-based SQL Injection via the 'link_url' parameter in all versions up to, and including, 7.9.2 due to… |
CVE-2026-93484 | | | 2026-10-15 | Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. This lack of proper sanitiz… |
CVE-2026-110911 | Critical | 9.8 | 2026-10-15 | Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the que… |
CVE-2026-110840 | | | 2026-10-14 | n8n before 2.41.4 and 2.42.x before 2.42.1 contains an SQL injection vulnerability in version 1 of the Microsoft SQL node, which substitutes Query field expres… |
CVE-2026-110670 | High | 7.3 | 2026-10-14 | A vulnerability was found in cemtan sar2html 4.0.0. The affected element is the function updateDb of the file sar2html.py of the component Archive Processing… |
CVE-2026-55684 | Critical | 9.8 | 2026-10-14 | WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobrancas_geracao.php endpoint accepts… |
CVE-2026-55683 | Critical | 9.8 | 2026-10-14 | WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobranca.php endpoint accepts POST inpu… |
CVE-2026-55681 | High | 8.8 | 2026-10-14 | WeGIA is a web manager for charitable institutions. Prior to 3.8.6, an authenticated user with access to the Material & Patrimônio module can submit id_produto… |
CVE-2026-55680 | Critical | 9.8 | 2026-10-14 | WeGIA is a web manager for charitable institutions. Prior to 3.8.6, unauthenticated POST requests to web/html/socio/sistema/cadastro_cobranca.php can place a q… |
CVE-2026-55679 | Medium | 6.5 | 2026-10-14 | WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the pre-installation web/instalador/instalador.php endpoint is reachable before config.php… |
CVE-2026-55386 | | | 2026-10-14 | InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, Inv… |
CVE-2026-110668 | High | 7.3 | 2026-10-14 | A weakness has been identified in cemtan sar2html 4.0.0. Affected by this issue is the function index of the file sar2html.py. This manipulation of the argumen… |
CVE-2026-104142 | | | 2026-10-14 | DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store crafted FieldGroupDTO.min, FieldGroupDTO.max… |
CVE-2026-104141 | | | 2026-10-14 | DataEase is an open source data visualization and analysis tool. Authenticated users with datasource access can supply crafted schema names, connection usernam… |
CVE-2026-55572 | Critical | 10.0 | 2026-10-14 | e107 is a content management system (CMS). Prior to 2.3.7, the bundled alt_auth plugin's otherdb and e107db authentication backends interpolate the submitted l… |
CVE-2026-42093 | | | 2026-10-14 | Redash is a package for data visualization and sharing. From versions after 8.0.0 until 26.9.0, the Query Results query runner in redash/query_runner/query_res… |
CVE-2026-103946 | High | 8.3 | 2026-10-14 | An SQL injection vulnerability could allow an authenticated user to read or modify data stored by Nessus. |
CVE-2026-101997 | High | 8.1 | 2026-10-14 | An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ipfd of Juniper Networks Junos OS on SRX Series allows… |
CVE-2026-89076 | High | 7.2 | 2026-10-14 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Progress MOVEit Transfer (Custom Reports module).
This i… |
CVE-2026-110614 | Medium | 6.5 | 2026-10-14 | Yiuman citrus through 0.15.0 contains an ORDER BY sql injection vulnerability in the citrus-support generic query framework that allows users to inject SQL via… |
CVE-2026-110609 | Medium | 6.5 | 2026-10-14 | Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword… |
CVE-2026-94348 | Medium | 6.1 | 2026-10-14 | Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne… |
CVE-2026-108065 | Critical | 9.8 | 2026-10-14 | SQL Injection (CWE-89) in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce [VERSION — missing] allows an una… |
CVE-2026-105067 | High | 8.5 | 2026-10-14 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Webnus Modern Events Calendar Lite modern-events-calendar… |
CVE-2026-109901 | High | 8.5 | 2026-10-14 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Codepeople CP Multi View Event Calendar cp-multi-view-ca… |
CVE-2026-105107 | High | 7.6 | 2026-10-14 | Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/cat_issues_top.pl script (sub calculate) concatenates the user-controlled… |
CVE-2026-89310 | Critical | 9.9 | 2026-10-14 | A parameter taken from the request body is inserted into
a T-SQL statement without parameterization or escaping, allowing
a remote attacker to execute arbitrar… |
CVE-2026-89288 | High | 8.6 | 2026-10-14 | The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing… |
CVE-2026-103307 | High | 8.6 | 2026-10-14 | The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it in a SQL statement… |
CVE-2026-101926 | Medium | 6.5 | 2026-10-14 | The Hyyan WooCommerce Polylang Integration plugin for WordPress is vulnerable to SQL Injection via the 'variation_ids' parameter of the 'woocommerce_remove_var… |
CVE-2026-96661 | High | 7.5 | 2026-10-14 | The Gmedia Photo Gallery plugin for WordPress is vulnerable to time-based SQL Injection via the 'gmedia__in' parameter in all versions up to, and including, 1… |
CVE-2026-95808 | High | 7.5 | 2026-10-14 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via the 'inputs' parameter… |
CVE-2026-78193 | High | 7.5 | 2026-10-14 | The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via 'product.push' Identity Endpoint in all versions up to, an… |
CVE-2026-97668 | Critical | 9.8 | 2026-10-14 | The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart persistent meta_value in all versions up to, and… |
CVE-2026-102251 | High | 7.5 | 2026-10-14 | The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'validate' parameter in all versions up to, and incl… |
CVE-2026-63165 | High | 8.1 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject malicious SQL by ma… |
CVE-2026-63154 | High | 8.8 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying… |
CVE-2026-63152 | High | 8.1 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability that allows authenticated attackers to inject malicious SQL via the… |
CVE-2026-110083 | High | 7.1 | 2026-10-13 | Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result… |
CVE-2026-88075 | High | 8.8 | 2026-10-13 | Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevat… |
CVE-2026-70266 | High | 8.8 | 2026-10-13 | Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to elevate pr… |
CVE-2026-70049 | High | 8.0 | 2026-10-13 | Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevat… |
CVE-2026-23707 | High | 7.2 | 2026-10-13 | An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 th… |
CVE-2026-23706 | Medium | 6.5 | 2026-10-13 | An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 th… |
CVE-2026-23705 | High | 7.2 | 2026-10-13 | An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 th… |
CVE-2025-57739 | High | 8.8 | 2026-10-13 | An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0 throug… |
CVE-2025-46773 | High | 8.8 | 2026-10-13 | An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 th… |
CVE-2026-55823 | | | 2026-10-13 | Frappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview composes a count operation around generated SQL throug… |
CVE-2026-109620 | High | 7.3 | 2026-10-13 | A vulnerability has been found in SourceCodester Online Reviewer System 1.0. Affected by this vulnerability is the function PDO::prepare of the file login/inde… |
CVE-2026-109607 | High | 7.3 | 2026-10-13 | A flaw has been found in SourceCodester Online Exam System 1.0. Affected is an unknown function of the file adminpanel/admin/query/loginExe.php of the componen… |
CVE-2026-109606 | High | 7.3 | 2026-10-13 | A vulnerability was detected in SourceCodester Art Gallery Management System 1.0. This impacts the function Action::save_user of the file admin/admin_class.php… |
CVE-2026-109523 | High | 7.3 | 2026-10-13 | A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this vulnerability is an… |
CVE-2026-109522 | High | 7.3 | 2026-10-13 | A vulnerability has been found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected is an unknown function… |
CVE-2026-109521 | High | 7.3 | 2026-10-13 | A vulnerability was detected in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown function… |
CVE-2026-63316 | | | 2026-10-13 | A SQL injection vulnerability has been identified in Payload CMS. Improper neutralization of input provided by user into "in" and "not_in" query paramethers al… |
CVE-2026-89201 | High | 7.5 | 2026-10-13 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in device group or… |
CVE-2026-89200 | Medium | 6.7 | 2026-10-13 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Name and Va… |
CVE-2026-89198 | High | 8.8 | 2026-10-13 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize the filename of firmware… |
CVE-2026-89197 | High | 8.8 | 2026-10-13 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Value field… |
CVE-2026-89196 | High | 8.8 | 2026-10-13 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in facility names… |
CVE-2026-109687 | High | 7.6 | 2026-10-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Bl… |
CVE-2026-109115 | High | 7.3 | 2026-10-13 | A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects some unknown proces… |
CVE-2026-108179 | High | 7.6 | 2026-10-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PluginUs.Net WOLF bulk-editor allows Blind SQL Injection… |
CVE-2026-15399 | Medium | 4.9 | 2026-10-13 | The Animated Number Counters plugin for WordPress is vulnerable to generic SQL Injection via the 'counterid' parameter in all versions up to, and including, 3… |
CVE-2026-108970 | High | 7.3 | 2026-10-13 | A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function MySQLDB::add… |
CVE-2026-108968 | High | 7.3 | 2026-10-13 | A weakness has been identified in SourceCodester Performance Indicator System 1.0. The affected element is an unknown function of the file /opils/staff/sales_h… |
CVE-2026-108967 | High | 7.3 | 2026-10-13 | A security flaw has been discovered in SourceCodester Performance Indicator System 1.0. Impacted is an unknown function of the file /opils/staff/edit_credit.ph… |
CVE-2026-108966 | High | 7.3 | 2026-10-13 | A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the file /opils/staff/product… |
CVE-2026-108965 | High | 7.3 | 2026-10-13 | A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/edit_quanti… |
CVE-2026-108964 | High | 7.3 | 2026-10-13 | A vulnerability was found in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/admin/addproduct.php. Performing… |
CVE-2026-108959 | Medium | 6.3 | 2026-10-13 | A security vulnerability has been detected in itsourcecode Online Cake Ordering System 1.0. This impacts an unknown function of the file /addtransacdetail.php… |
CVE-2026-108956 | High | 7.3 | 2026-10-13 | A vulnerability was identified in code-projects Online Reviewer System 1.0. The affected element is an unknown function of the file /reviewer/system/system/adm… |
CVE-2026-89113 | High | 8.8 | 2026-10-13 | SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send… |
CVE-2026-109674 | Medium | 6.5 | 2026-10-12 | Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints caused by missing input validation. Remote authe… |
CVE-2026-109663 | Medium | 6.5 | 2026-10-12 | Frappe ERPNext before 15.113.0 and 16.x before 16.22.0 contains an SQL injection vulnerability caused by missing input validation in some endpoints. Authentica… |
CVE-2026-109649 | Medium | 6.5 | 2026-10-12 | Frappe ERPNext before 15.102.0 and 16.x before 16.11.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing mani… |
CVE-2026-109648 | Medium | 6.5 | 2026-10-12 | Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated… |
CVE-2026-109647 | Medium | 6.5 | 2026-10-12 | Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in multiple endpoints caused by missing input validation. Authen… |
CVE-2026-109646 | Medium | 6.5 | 2026-10-12 | Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated… |
CVE-2026-109639 | Medium | 6.5 | 2026-10-12 | Frappe ERPNext before 15.102.0 and 16.x before 16.8.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manip… |
CVE-2026-109638 | Medium | 6.5 | 2026-10-12 | Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Authenticat… |