CVE-2026-95605 | Critical | 9.3 | 2026-10-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Passionate Programmer Peter WP Data Access allows Blind S… |
CVE-2026-76452 | Medium | 4.9 | 2026-10-07 | A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an aut… |
CVE-2026-62251 | High | 8.1 | 2026-10-07 | Homer is open source telecom observability software. Prior to version 11.0.283, the `V4StatisticsQuery` handler passes the user-supplied `rawquery` field direc… |
CVE-2026-42710 | High | 7.6 | 2026-10-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 10Web Slider by 10Web slider-wd allows Blind SQL Injectio… |
CVE-2026-42708 | High | 7.6 | 2026-10-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AF themes WP Post Author wp-post-author allows Blind SQL… |
CVE-2026-42714 | High | 7.6 | 2026-10-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Piggly Dev Pix por Piggly (para Woocommerce) pix-por-pigg… |
CVE-2026-42713 | High | 7.6 | 2026-10-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Gopiplus Post title marquee scroll post-title-marquee-scr… |
CVE-2026-103668 | High | 8.6 | 2026-10-07 | An SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary SQL quer… |
CVE-2026-42721 | High | 7.6 | 2026-10-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SERVIT Software Solutions affiliate-toolkit affiliate-too… |
CVE-2026-42720 | High | 7.6 | 2026-10-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sarah Giles Dynamic User Directory dynamic-user-directory… |
CVE-2026-107103 | | | 2026-10-07 | This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint. An unauthenticated r… |
CVE-2026-102782 | | | 2026-10-07 | Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0 - site/simplemembership.php dispatches task=checkLoginPas… |
CVE-2026-104953 | Medium | 6.8 | 2026-10-07 | The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users wi… |
CVE-2026-104667 | Medium | 6.8 | 2026-10-07 | The Animated Number Counters WordPress plugin before 3.1 does not sanitise or escape a value stored by an Editor-level user before concatenating it into a SQL… |
CVE-2026-79811 | High | 7.2 | 2026-10-06 | A SQL injection vulnerability in the API of ClearPass Policy Manager could allow a remote authenticated attacker with administrative privileges to conduct SQL… |
CVE-2026-79798 | Critical | 9.9 | 2026-10-06 | SQL injection vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow a low-privileged authenticated remote attacker to c… |
CVE-2026-79794 | Critical | 9.1 | 2026-10-06 | A SQL injection vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL inj… |
CVE-2025-45871 | High | 8.1 | 2026-10-06 | LogicalDOC Enterprise up to and for 9.1.1 is vulnerable to blind SQL injection in the WorkflowsDataServlet component, allowing authenticated user to manipulate… |
CVE-2026-105957 | Medium | 6.3 | 2026-10-06 | A vulnerability was detected in SourceCodester Performance Indicator System 1.0. The affected element is an unknown function of the file /opils/admin/view_prod… |
CVE-2026-105856 | | | 2026-10-06 | Payload is a free and open source headless content management system. Prior to 3.90.0 and 4.0.0-canary.34, an attacker with read and create or update access to… |
CVE-2026-105845 | Critical | 9.8 | 2026-10-06 | Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an untru… |
CVE-2026-105921 | Medium | 6.3 | 2026-10-06 | A vulnerability was identified in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This affects an unknown function of t… |
CVE-2026-105920 | High | 7.3 | 2026-10-06 | A vulnerability was determined in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The impacted element is an unknown fu… |
CVE-2026-105919 | High | 7.3 | 2026-10-06 | A vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The affected element is the function mysql… |
CVE-2026-105918 | High | 7.3 | 2026-10-06 | A vulnerability has been found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Impacted is the function mysql_error… |
CVE-2026-4889 | | | 2026-10-06 | SQL injection (SQLi) vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/ajax/users.php?op=ve… |
CVE-2026-42417 | Critical | 9.3 | 2026-10-06 | Unauthenticated SQL Injection in ARMember Premium <= 7.8 versions. |
CVE-2026-42416 | High | 8.5 | 2026-10-06 | Subscriber SQL Injection in UDesign Core <= 4.15.0 versions. |
CVE-2026-42415 | Critical | 9.3 | 2026-10-06 | Unauthenticated SQL Injection in Porto Theme - Functionality <= 3.9.3 versions. |
CVE-2026-42414 | High | 8.5 | 2026-10-06 | Subscriber SQL Injection in ListingPro <= 2.9.12 versions. |
CVE-2026-41555 | Critical | 9.3 | 2026-10-06 | Unauthenticated SQL Injection in Newsletter Subscription Form – User Subscriptions Form, Capture Email <= 1.5.9 versions. |
CVE-2026-39795 | Critical | 9.3 | 2026-10-06 | Unauthenticated SQL Injection in SendPress Newsletters <= 1.26.1.20 versions. |
CVE-2026-39785 | Critical | 9.3 | 2026-10-06 | Unauthenticated SQL Injection in Gmedia Photo Gallery <= 1.25.1 versions. |
CVE-2026-39771 | High | 8.5 | 2026-10-06 | Subscriber SQL Injection in Buddyboss Platform <= 3.1.0 versions. |
CVE-2026-39764 | Critical | 9.3 | 2026-10-06 | Unauthenticated SQL Injection in Radius Booking — Booking Calendar for Appointments & Services <= 1.0.19 versions. |
CVE-2026-39747 | High | 8.5 | 2026-10-06 | Subscriber SQL Injection in Woffice <= 5.4.35 versions. |
CVE-2026-39746 | Critical | 9.3 | 2026-10-06 | Unauthenticated SQL Injection in Booknetic <= 4.8.5 versions. |
CVE-2026-32581 | High | 7.1 | 2026-10-06 | Subscriber SQL Injection in Mooberry Book Manager 4.16.2 versions. |
CVE-2026-32580 | High | 7.5 | 2026-10-06 | Unauthenticated SQL Injection in WooCommerce Lottery <= 2.2.9 versions. |
CVE-2026-32557 | Critical | 9.3 | 2026-10-06 | Unauthenticated SQL Injection in WooCommerce Appointments <= 5.3.2 versions. |
CVE-2026-25434 | High | 8.5 | 2026-10-06 | Subscriber SQL Injection in WP2LEADS <= 3.5.7 versions. |
CVE-2026-105317 | High | 8.5 | 2026-10-06 | Subscriber SQL Injection in Paid Member Subscriptions <= 3.1.1 versions. |
CVE-2026-105807 | High | 7.3 | 2026-10-06 | A vulnerability was found in SourceCodester Simple Student Information System 1.0. This affects an unknown part of the file searchquery.php. Performing a manip… |
CVE-2026-105776 | High | 7.3 | 2026-10-06 | A flaw has been found in bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL up to ae783195ba7e0390d3b3bfaddd99944b7e9735a4. Affected by this… |
CVE-2026-105472 | Medium | 6.3 | 2026-10-06 | A weakness has been identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. The affected element is an unkn… |
CVE-2026-105471 | High | 7.3 | 2026-10-06 | A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Impacted is an unknown fun… |
CVE-2026-105470 | High | 7.3 | 2026-10-05 | A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This issue affects the function… |
CVE-2026-105469 | High | 7.3 | 2026-10-05 | A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This vulnerability affects unkn… |
CVE-2026-105468 | High | 7.3 | 2026-10-05 | A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects the function mysqli_que… |
CVE-2026-71298 | Medium | 6.4 | 2026-10-05 | A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the `orderBy` query parameter of its REST API list endpoints. Thi… |
CVE-2026-105388 | Medium | 6.3 | 2026-10-05 | A weakness has been identified in feelec-yishu feelcrm-os 1.0.0. This vulnerability affects the function index of the file App/Feelcrm/Index/Controller/MemberC… |
CVE-2026-103066 | High | 8.5 | 2026-10-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-s… |
CVE-2026-88424 | Critical | 9.8 | 2026-10-05 | FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter(). This vulnerability all… |
CVE-2026-105387 | High | 7.3 | 2026-10-05 | A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects the function… |
CVE-2026-105386 | High | 7.3 | 2026-10-05 | A vulnerability was identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Affected by this issue is the functi… |
CVE-2026-103352 | Critical | 9.3 | 2026-10-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-s… |
CVE-2026-105385 | High | 7.3 | 2026-10-05 | A vulnerability was determined in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Affected by this vulnerability is an… |
CVE-2026-105384 | High | 7.3 | 2026-10-05 | A vulnerability was found in UNION HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Affected is an unknown function of the file patient… |
CVE-2026-105383 | High | 7.3 | 2026-10-05 | A vulnerability has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This impacts an unknown function of… |
CVE-2026-88397 | Medium | 6.5 | 2026-10-05 | ApiAdmin v.5.0 and before is vulnerable to SQL Injection in the user-list endpoint GET /admin/User/getUsers via the gid parameter. |
CVE-2026-88395 | Critical | 9.8 | 2026-10-05 | GouGuOA v6.0.5 and before is vulnerable to SQL Injection in /home/message/rubbish via the keywords parameter. |
CVE-2026-102428 | | | 2026-10-05 | Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16 - The order column for records was user provided and not proper… |
CVE-2026-105287 | Medium | 6.3 | 2026-10-05 | A flaw has been found in feelec-yishu feelcrm-os 1.0.0. Affected is an unknown function of the file App/Feelcrm/Crm/Controller/AjaxRequestController.class.php… |
CVE-2026-105254 | Medium | 6.3 | 2026-10-05 | A vulnerability was identified in itsourcecode Online Admission System 1.0. Impacted is an unknown function of the file /admin/schoolyear.php. Such manipulatio… |
CVE-2026-105253 | High | 7.3 | 2026-10-05 | A vulnerability was determined in itsourcecode Online Admission System Project 1.0. This issue affects some unknown processing of the file /admin/login1.php. T… |
CVE-2026-104408 | High | 7.6 | 2026-10-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Groundhogg Groundhogg groundhogg allows Blind SQL Injecti… |
CVE-2026-104389 | High | 8.5 | 2026-10-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sirv Sirv sirv allows Blind SQL Injection.This issue affe… |
CVE-2026-105247 | High | 7.3 | 2026-10-05 | A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /reviewer_0/adm… |
CVE-2026-105246 | High | 7.3 | 2026-10-05 | A vulnerability was found in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer_0/admins/assessments/S… |
CVE-2026-105232 | High | 7.3 | 2026-10-05 | A flaw has been found in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. The impacted… |
CVE-2026-105231 | High | 7.3 | 2026-10-05 | A vulnerability was detected in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. The a… |
CVE-2026-105230 | High | 7.3 | 2026-10-05 | A security vulnerability has been detected in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79… |
CVE-2026-105229 | High | 7.3 | 2026-10-05 | A weakness has been identified in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. Thi… |
CVE-2026-105187 | Medium | 6.3 | 2026-10-05 | A vulnerability has been found in itsourcecode Online Admission System 1.0. Affected is an unknown function of the file /admin/key.php. The manipulation of the… |
CVE-2026-105186 | Medium | 6.3 | 2026-10-05 | A flaw has been found in itsourcecode Online Admission System 1.0. This impacts an unknown function of the file /new.php. Executing a manipulation of the argum… |
CVE-2026-105185 | High | 7.3 | 2026-10-05 | A vulnerability was detected in itsourcecode Online Admission System 1.0. This affects an unknown function of the file /admin/examinee.php. Performing a manipu… |
CVE-2026-105184 | High | 7.3 | 2026-10-05 | A security vulnerability has been detected in itsourcecode Online Admission System 1.0. The impacted element is an unknown function of the file /admin/creteria… |
CVE-2026-105183 | High | 7.3 | 2026-10-05 | A weakness has been identified in itsourcecode Online Admission System 1.0. The affected element is an unknown function of the file /admin/confirm.php. This ma… |
CVE-2026-105182 | High | 7.3 | 2026-10-05 | A security flaw has been discovered in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer_0/admins/ass… |
CVE-2026-105181 | Medium | 6.3 | 2026-10-05 | A vulnerability was identified in itsourcecode Online Admission System 1.0. This issue affects some unknown processing of the file register1.php. The manipulat… |
CVE-2026-105178 | Medium | 4.7 | 2026-10-05 | A security flaw has been discovered in SourceCodester Drug Recommendation System 1.0. The impacted element is the function mysqli_real_escape_string of the fil… |
CVE-2026-105177 | Medium | 4.7 | 2026-10-05 | A vulnerability was identified in SourceCodester Drug Recommendation System 1.0. The affected element is an unknown function of the file /Admin/add_drug.php of… |
CVE-2026-105176 | Medium | 4.7 | 2026-10-05 | A vulnerability was determined in SourceCodester Drug Recommendation System 1.0. Impacted is an unknown function of the file /Admin/edit_class.php. This manipu… |
CVE-2026-105175 | High | 7.3 | 2026-10-05 | A vulnerability was found in SourceCodester Drug Recommendation System 1.0. This issue affects some unknown processing of the file /Auth/add_student.php of the… |
CVE-2026-105172 | High | 7.3 | 2026-10-05 | A vulnerability was detected in itsourcecode Online Admission System 1.0. Affected by this issue is some unknown functionality of the file /login1.php. Perform… |
CVE-2026-105169 | High | 7.3 | 2026-10-05 | A security flaw has been discovered in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c… |
CVE-2026-105168 | Medium | 6.3 | 2026-10-05 | A vulnerability was identified in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. Thi… |
CVE-2026-105167 | High | 7.3 | 2026-10-04 | A vulnerability was determined in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. The… |
CVE-2026-105166 | High | 7.3 | 2026-10-04 | A vulnerability was found in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. The affe… |
CVE-2026-105158 | High | 7.3 | 2026-10-04 | A vulnerability was detected in RainyGao DocSys up to 2.02.85. The impacted element is the function BaseController.createDBForMysql of the file BaseController… |
CVE-2026-105149 | High | 7.3 | 2026-10-04 | A security flaw has been discovered in mooSocial up to 3.2.4. This issue affects some unknown processing of the file /stores/all-products. Performing a manipul… |
CVE-2026-105146 | Medium | 4.7 | 2026-10-04 | A vulnerability was found in Comsenz Discuz! X5.0-20260801/X5.0-20260820/X5.0-20260910. Affected by this issue is the function modmedalsubmit of the file uploa… |
CVE-2026-103355 | Critical | 9.3 | 2026-10-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free… |
CVE-2026-96267 | High | 7.5 | 2026-10-03 | The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to generic SQL Injection via the 'fullRef' parameter in all versions up to, an… |
CVE-2026-18443 | High | 8.8 | 2026-10-03 | The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via the 'access_privilege… |
CVE-2026-92923 | Medium | 6.3 | 2026-10-03 | The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise and escape a parameter before using it in a SQL statement, allowing users… |
CVE-2026-89236 | High | 8.6 | 2026-10-03 | The SaveTo Wishlist Lite WordPress plugin before 1.1.5 does not sanitise and escape parameters before using them in the ORDER BY clause of a SQL query, allowi… |
CVE-2026-85568 | Medium | 6.8 | 2026-10-03 | The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not correctly handle a search value before rewriting an already prepared SQL statement… |
CVE-2026-103913 | High | 7.5 | 2026-10-03 | The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the stored latitude/longitude coordinates of a listing in versions up to, and includin… |
CVE-2026-95865 | Medium | 6.5 | 2026-10-03 | The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to blind SQL Injection via 'fields[][value]' Parameter in al… |