Export limit exceeded: 21300 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (21300 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-108107 | 1 Hotspotbilling | 1 Phpnuxbill | 2026-10-11 | 9.8 Critical |
| PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw() queries. Attackers can send crafted username, macAddr or nasid parameters to the accounting or authenticate actions to extract customer records and credentials via time-based blind SQL injection. | ||||
| CVE-2026-96809 | 2026-10-11 | 9.3 Critical | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MultiNet Interactive AB EduAdmin Booking eduadmin-booking allows Blind SQL Injection.This issue affects EduAdmin Booking: from n/a before 6.0.0. | ||||
| CVE-2026-96330 | 2026-10-11 | 9.3 Critical | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tagDiv tagDiv Opt-In Builder td-subscription allows Blind SQL Injection.This issue affects tagDiv Opt-In Builder: from n/a through 1.7.6. | ||||
| CVE-2026-96329 | 2026-10-11 | 8.5 High | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tagDiv tagDiv Opt-In Builder td-subscription allows Blind SQL Injection.This issue affects tagDiv Opt-In Builder: from n/a through 1.7.6. | ||||
| CVE-2026-89304 | 2026-10-11 | 6.5 Medium | ||
| The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform blind SQL injection attacks. | ||||
| CVE-2026-89297 | 2026-10-11 | 8.6 High | ||
| The Loja Automática WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks. | ||||
| CVE-2026-89287 | 2026-10-11 | 8.6 High | ||
| The ASPL Product Quotation WordPress plugin through 1.1.0 does not sanitize and escape a parameter before using it in SQL statements, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database. | ||||
| CVE-2026-89285 | 2026-10-11 | 8.6 High | ||
| The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several request parameters before using them to build a SQL query, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database. | ||||
| CVE-2026-89234 | 2026-10-11 | 8.6 High | ||
| The WP-Partner WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database. | ||||
| CVE-2026-89232 | 2026-10-11 | 8.6 High | ||
| The Recordbrowser WordPress plugin through 1.1.7 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database. | ||||
| CVE-2026-89213 | 2026-10-11 | 8.6 High | ||
| The Llavero.io WordPress plugin through 0.1.4 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database. | ||||
| CVE-2026-89195 | 2026-10-11 | 8.6 High | ||
| The Site Setup Wizard WordPress plugin through 1.5.8 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database. | ||||
| CVE-2026-88930 | 2026-10-11 | 8.6 High | ||
| The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requests authorised by it, and does not sanitise and escape a parameter before using it in an SQL statement, allowing unauthenticated users to perform SQL injection attacks. | ||||
| CVE-2026-81420 | 2026-10-11 | 8.6 High | ||
| The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it in a SQL statement in one of its unauthenticated AJAX actions, allowing unauthenticated users to perform SQL injection attacks. | ||||
| CVE-2026-62117 | 2026-10-11 | 8.5 High | ||
| Subscriber SQL Injection in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions. | ||||
| CVE-2026-62031 | 2026-10-11 | 9.3 Critical | ||
| Unauthenticated SQL Injection in uListing <= 2.2.0 versions. | ||||
| CVE-2026-45440 | 2026-10-11 | 7.6 High | ||
| Administrator SQL Injection in WP Ultimate CSV Importer <= 9.2 versions. | ||||
| CVE-2026-42722 | 2026-10-11 | 7.6 High | ||
| Administrator SQL Injection in Frontend Admin by DynamiApps <= 3.29.13 versions. | ||||
| CVE-2026-42717 | 2026-10-11 | 7.6 High | ||
| Administrator SQL Injection in Leyka <= 3.32.3 versions. | ||||
| CVE-2026-42712 | 2026-10-11 | 8.5 High | ||
| Subscriber SQL Injection in Qode Tours <= 3.1.3.2 versions. | ||||