Total
20059 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-65462 | 2 Uncannyowl, Wordpress | 2 Uncanny Automator, Wordpress | 2026-07-23 | 7.6 High |
| Administrator SQL Injection in Uncanny Automator <= 7.3.2 versions. | ||||
| CVE-2026-13009 | 2 Wordpress, Wupsales | 2 Wordpress, Ai Copilot – Content Generator | 2026-07-23 | 6.5 Medium |
| The AI Copilot – Content Generator plugin for WordPress is vulnerable to generic SQL Injection via 'order[0][dir]' Parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The required waic-nonce is emitted on the front-end whenever the [waic_form] or [aiwu-form] shortcode is rendered, enabling contributor-level users who can publish shortcodes to obtain a valid nonce and reach the vulnerable AJAX handler, which performs no capability check beyond nonce verification when the shortcodes are not already embedded in a page. | ||||
| CVE-2026-15448 | 2 Tickera, Wordpress | 2 Tickera – Sell Tickets & Manage Events, Wordpress | 2026-07-23 | 6.5 Medium |
| The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tc_order_status_filter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with staff-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | ||||
| CVE-2026-61949 | 2 Bookly, Wordpress | 2 Bookly, Wordpress | 2026-07-23 | 9.3 Critical |
| Unauthenticated SQL Injection in Bookly <= 27.7 versions. | ||||
| CVE-2026-65532 | 2 Persianscript, Wordpress | 2 Persian Woocommerce Sms, Wordpress | 2026-07-23 | 7.6 High |
| Shop manager SQL Injection in Persian Woocommerce SMS <= 7.2.2 versions. | ||||
| CVE-2026-56292 | 1 Acymailing.com | 1 Acymailing.com Acymailing Extension For Joomla | 2026-07-23 | N/A |
| Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1 - A SQLi vulnerability in AcyMailing component < 10.11.1 for Joomla was discovered. Exploiting this flaw can lead to unauthorized database access and data leakage. | ||||
| CVE-2026-61950 | 2 Themetechmount, Wordpress | 2 Truebooker, Wordpress | 2026-07-23 | 9.3 Critical |
| Unauthenticated SQL Injection in TrueBooker <= 1.2.3 versions. | ||||
| CVE-2026-7253 | 1 Ibm | 3 Ibm Watson Speech Services Cartridge, Sterling B2b Integrator, Sterling File Gateway | 2026-07-23 | 6 Medium |
| IBM Sterling B2B Integrator and IBM Sterling File Gateway are vulnerable to SQL injection. A privileged user could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database. | ||||
| CVE-2026-59526 | 2 Romancode, Wordpress | 2 Mapsvg, Wordpress | 2026-07-23 | 9.3 Critical |
| Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions. | ||||
| CVE-2026-65451 | 2 Romancode, Wordpress | 2 Mapsvg, Wordpress | 2026-07-23 | 8.5 High |
| Contributor SQL Injection in MapSVG <= 8.14.0 versions. | ||||
| CVE-2026-15761 | 2 Tickera, Wordpress | 2 Tickera – Sell Tickets & Manage Events, Wordpress | 2026-07-23 | 6.5 Medium |
| The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tc_event_filter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with staff-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable code path is reachable by users holding the plugin's custom Staff role, as the plugin's add_required_capabilities() function grants that role the edit_tc_tickets_instances capability, providing access to the tc_tickets_instances admin list screen where the filter is applied. | ||||
| CVE-2026-16484 | 1 Sourcecodester | 1 Class And Exam Timetabling System | 2026-07-22 | 7.3 High |
| A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /edit_subjecta.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used. | ||||
| CVE-2026-16334 | 1 Itsourcecode | 1 Hospital Management System | 2026-07-22 | 6.3 Medium |
| A vulnerability was identified in itsourcecode Hospital Management System 1.0. This vulnerability affects unknown code of the file /prescriptionorder.php. Such manipulation of the argument editid leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used. | ||||
| CVE-2026-16152 | 1 Sourcecodester | 1 Class And Exam Timetabling System | 2026-07-22 | 7.3 High |
| A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /edit_rooma.php. Performing a manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. | ||||
| CVE-2026-16227 | 1 Sourcecodester | 1 Class And Exam Timetabling System | 2026-07-22 | 7.3 High |
| A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. This impacts an unknown function of the file /edit_subject.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. | ||||
| CVE-2026-16449 | 1 Zsadmin2025 | 1 Zs-admin | 2026-07-22 | 6.3 Medium |
| A vulnerability was determined in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. The impacted element is the function OrderItem.asc/OrderItem.desc of the file /api/system/sys/dept/page of the component com.zs.sys.dept.controller.SysDeptController. This manipulation of the argument orderField causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-16490 | 1 Itsourcecode | 1 Hospital Management System | 2026-07-22 | 6.3 Medium |
| A security flaw has been discovered in itsourcecode Hospital Management System 1.0. Impacted is an unknown function of the file /prescription.php. The manipulation of the argument editid results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. | ||||
| CVE-2026-8082 | 2026-07-21 | 7.5 High | ||
| The bpost-shipping-platform WordPress plugin before 3.2.3 does not properly sanitize a parameter before using it in a SQL query during WooCommerce order submission, allowing unauthenticated attackers to perform time-based blind SQL injection on stores running this bpost-shipping-platform WordPress plugin before 3.2.3. | ||||
| CVE-2026-16131 | 1 Itsourcecode | 1 Hospital Management System | 2026-07-21 | 6.3 Medium |
| A weakness has been identified in itsourcecode Hospital Management System 1.0. This affects an unknown function of the file /prescriptionrecord.php. This manipulation of the argument delid causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. | ||||
| CVE-2026-16014 | 1 Code-projects | 1 Hospital Bed Management System | 2026-07-21 | 7.3 High |
| A vulnerability was found in code-projects Hospital Bed Management System 1.0. This affects an unknown part of the component Login Form. Performing a manipulation of the argument Username results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. | ||||