Export limit exceeded: 20361 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (20361 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2016-20073 | 2 Mattkaye, Wordpress | 2 Answer My Question, Wordpress | 2026-06-23 | 8.2 High |
| Answer My Question 1.3 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' POST parameter. Attackers can submit crafted SQL statements to the modal.php endpoint to extract sensitive database information including WordPress terms and configuration data. | ||||
| CVE-2026-48114 | 1 Nceas | 1 Metacat | 2026-06-23 | 9.8 Critical |
| Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.0.0 and and above contain an unauthenticated SQL injection in the /harvesterRegistration endpoint. HarvesterRegistration.dbInsert() builds an INSERT against HARVEST_SITE_SCHEDULE via string concatenation, using a quoteString() helper that performs raw single-quote wrapping without escaping. Three request parameters reach the sink: unit, contactEmail, and documentListURL. The servlet does not verify a real LDAP identity. Allowing the vulnerable insert to proceed. Since the PostgreSQL backend permits stacked queries via Statement.executeUpdate(), this vulnerability allows full read/write/execute access in the Metacat database context. The vulnerability was remediated in Metacat 3.0.0. | ||||
| CVE-2026-39441 | 2 Naked Cat Plugins (by Webdados), Wordpress | 2 Feed Kuantokusta For Woocommerce – Free, Wordpress | 2026-06-23 | 9.3 Critical |
| Unauthenticated SQL Injection in Feed KuantoKusta for WooCommerce – Free <= 5.3 versions. | ||||
| CVE-2026-39492 | 2 Flipper Code – Wordpress Development Company, Wordpress | 2 Wp Maps, Wordpress | 2026-06-23 | 9.3 Critical |
| Unauthenticated SQL Injection in WP Maps <= 4.9.1 versions. | ||||
| CVE-2026-39511 | 2 Jacob N. Breetvelt, Wordpress | 2 Wp Photo Album Plus, Wordpress | 2026-06-23 | 9.3 Critical |
| Unauthenticated SQL Injection in WP Photo Album Plus <= 9.1.08.001 versions. | ||||
| CVE-2026-39519 | 2 Ahmad, Wordpress | 2 Geekybot, Wordpress | 2026-06-23 | 9.3 Critical |
| Unauthenticated SQL Injection in GeekyBot <= 1.2.0 versions. | ||||
| CVE-2026-39530 | 2 Speakout!, Wordpress | 2 Speakout! Email Petitions, Wordpress | 2026-06-23 | 9.3 Critical |
| Unauthenticated SQL Injection in SpeakOut! Email Petitions <= 4.6.5 versions. | ||||
| CVE-2026-40771 | 2 Wasiliy Strecker, Wordpress | 2 Contest Gallery, Wordpress | 2026-06-23 | 9.3 Critical |
| Unauthenticated SQL Injection in Contest Gallery <= 28.1.6 versions. | ||||
| CVE-2026-42381 | 2 Funnelkit, Wordpress | 2 Funnel Builder By Funnelkit, Wordpress | 2026-06-23 | 9.3 Critical |
| Unauthenticated SQL Injection in Funnel Builder by FunnelKit <= 3.15.0.1 versions. | ||||
| CVE-2026-42665 | 2 Passionate Programmer Peter, Wordpress | 2 Wp Data Access, Wordpress | 2026-06-23 | 9.3 Critical |
| Unauthenticated SQL Injection in WP Data Access <= 5.5.70 versions. | ||||
| CVE-2026-45439 | 2 Realtyna, Wordpress | 2 Realtyna Organic Idx Plugin, Wordpress | 2026-06-23 | 9.3 Critical |
| Unauthenticated SQL Injection in Realtyna Organic IDX plugin <= 5.1.0 versions. | ||||
| CVE-2026-48886 | 2 Ahmad, Wordpress | 2 Js Help Desk, Wordpress | 2026-06-23 | 9.3 Critical |
| Unauthenticated SQL Injection in JS Help Desk <= 3.0.9 versions. | ||||
| CVE-2026-49067 | 2 Wordpress, Yydevelopment | 2 Wordpress, Advanced 301 And 302 Redirect | 2026-06-23 | 9.3 Critical |
| Unauthenticated SQL Injection in Advanced 301 and 302 Redirect <= 1.6.9 versions. | ||||
| CVE-2026-52700 | 2 Wcmultishipping – Mondial Relay & Chronopost For Wooommerce, Wordpress | 2 Wcmultishipping, Wordpress | 2026-06-23 | 8.5 High |
| Subscriber SQL Injection in WCMultiShipping <= 3.0.2 versions. | ||||
| CVE-2026-8443 | 2 Wordpress, Wpreviewslider | 2 Wordpress, Wp Review Slider Pro | 2026-06-23 | 8.8 High |
| The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'stypes' and 'slocations' parameters of the wppro_get_overall_chart_data AJAX action in versions up to, and including, 12.6.8. This is due to the use of stripslashes() on user-supplied JSON strings prior to json_decode(), which removes the escaping applied by WordPress's wp_magic_quotes; the resulting decoded array values are then concatenated directly into SQL WHERE clauses without parameterization, and the constructed query is executed via $wpdb->get_results() without $wpdb->prepare(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The handler also returns the executed SQL string in its JSON response, which simplifies oracle construction for blind exploitation. | ||||
| CVE-2026-8444 | 2 Wordpress, Wpreviewslider | 2 Wordpress, Wp Review Slider Pro | 2026-06-23 | 8.8 High |
| The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'curselrevs[]' parameter of the wpfb_find_reviews AJAX action in versions up to, and including, 12.6.8. This is due to the handler reading $_POST['curselrevs'] raw with no sanitization or type casting, then concatenating each array element directly into a `WHERE id IN ( ... )` clause without quoting and executing via $wpdb->get_results() without $wpdb->prepare(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | ||||
| CVE-2026-39574 | 2 Realmag777, Wordpress | 2 Inpost Gallery, Wordpress | 2026-06-23 | 9.3 Critical |
| Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions. | ||||
| CVE-2026-52715 | 2 Eyal Fitoussi, Wordpress | 2 Geo My Wordpress, Wordpress | 2026-06-23 | 9.3 Critical |
| Unauthenticated SQL Injection in GEO my WordPress <= 4.5.5 versions. | ||||
| CVE-2026-12775 | 1 Montodel | 1 House-rental-management | 2026-06-23 | 7.3 High |
| A vulnerability was detected in Montodel House-Rental-Management up to 90010017b81265eb1ef3810268909f7719a33863. Affected by this issue is some unknown functionality of the file /login.php. The manipulation of the argument Username results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-12776 | 1 Montodel | 1 House-rental-management | 2026-06-22 | 6.3 Medium |
| A flaw has been found in Montodel House-Rental-Management up to 90010017b81265eb1ef3810268909f7719a33863. This affects an unknown part of the file /index.php?page=houses. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way. | ||||