Catalog

Findings

Filter the merged record by severity, source, stack, and weakness type.

SearchSeveritySourceStackWeaknessSort

Known exploited only

Reset

High8.8RT is an open source, enterprise-grade issue and ticket tracking system.CVE-2026-41075 · CVE.org · NIST NVDMay 22, 2026
High8.7A SQL injection vulnerability has been identified in STER.CVE-2026-25606 · CVE.org · NIST NVDMay 22, 2026
High7.5The WP ERP Pro plugin for WordPress is vulnerable to SQL Injection via the 'search_key' parameter in all versions up to, and including, 1.5.1.CVE-2026-4834 · CVE.org · NIST NVD · WordPressMay 22, 2026
High7.1Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/statistics.php where the tick_id and f_tick_id POST parameters are concatenated into WHE…CVE-2026-48240 · CVE.org · NIST NVDMay 21, 2026
High7.1Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/reports.php where the tick_id POST parameter is concatenated into the WHERE clause of SE…CVE-2026-48239 · CVE.org · NIST NVDMay 21, 2026
High7.1Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/mobile_main.php where the id GET parameter is concatenated into the WHERE clause of a SE…CVE-2026-48238 · CVE.org · NIST NVDMay 21, 2026
High7.1Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in message.php where the frm_ticket_id and frm_resp_id POST parameters are concatenated into WHE…CVE-2026-48237 · CVE.org · NIST NVDMay 21, 2026
High7.1Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in db_loader.php where the multiple POST parameters (ticketsdb, ticketshost, ticketsuser, ticket…CVE-2026-48236 · CVE.org · NIST NVDMay 21, 2026
High8.8Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in incs/remotes.inc.php where latitude, longitude, callsign, mph, altitude, and timestamp values…CVE-2026-48235 · CVE.org · NIST NVDMay 21, 2026
High7.1Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in portal/ajax/list_requests.php where the sort and dir GET parameters are concatenated into the…CVE-2026-48234 · CVE.org · NIST NVDMay 21, 2026
High7.1Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/sit_incidents.php where the offset GET parameter is concatenated into the LIMIT clause o…CVE-2026-48233 · CVE.org · NIST NVDMay 21, 2026
High7.1Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/fullsit_incidents.php where the offset GET parameter is concatenated into the LIMIT clau…CVE-2026-48232 · CVE.org · NIST NVDMay 21, 2026
High7.1Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in tables.php where the multiple POST parameters (tablename, indexname, sortby) are concatenated…CVE-2026-48231 · CVE.org · NIST NVDMay 21, 2026
Critical9.3Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wp Directory Kit WP Directory Kit allows Blind SQL Injection.CVE-2026-39531 · CVE.org · NIST NVDMay 21, 2026
High8.8An SQL injection vulnerability in the MySQL CNID backend in Netatalk 3.1.0 through 4.4.2 allows a remote authenticated attacker to obtain unauthorized access to data,…CVE-2026-44047 · CVE.org · NIST NVDMay 21, 2026
Medium6.5SQL injection in InfoScale VIOM before v9.1.3 allows remote attackers to escalate privileges.CVE-2026-44923 · veritas · infoscale operations manager · CVE.org · NIST NVD · VeritasMay 20, 2026
Critical9.8Drupal Core SQL Injection VulnerabilityCVE-2026-9082 · drupal · drupal · CISA KEV · CVE.org · Drupal Security · DrupalKEVEPSS 15.7%May 20, 2026
High7.6Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YITH YITH WooCommerce Product Add-Ons allows Blind SQL Injection.CVE-2026-42383 · CVE.org · NIST NVD · WordPressMay 20, 2026
Critical9.3SureCart version prior to 4.2.1 are vulnerable to authenticated SQL injection via multiple parameters ('model_name', 'model_id', 'integration_id', 'provider') on the R…CVE-2026-9065 · CVE.org · NIST NVD · WordPressMay 20, 2026
Critical9.3NextGEN Gallery version prior to 4.2.1 are vulnerable to authenticated SQL injection via the 'orderby' parameter on the REST API endpoints '/imagely/v1/galleries' and…CVE-2026-9059 · CVE.org · NIST NVDMay 20, 2026
High7.5The Boost plugin for WordPress is vulnerable to time-based SQL Injection via the 'current_url' and 'user_name' parameters in versions up to, and including, 2.0.3 due t…CVE-2026-9010 · CVE.org · NIST NVD · WordPressMay 20, 2026
High8.7E-LAN Hybrid Recording System developed by TONNET has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read…CVE-2026-9003 · CVE.org · NIST NVDMay 20, 2026
Medium6.5The Infility Global plugin for WordPress is vulnerable to SQL Injection via the 'orderby' and 'order' parameters in all versions up to, and including, 2.15.16.CVE-2026-8685 · CVE.org · NIST NVD · WordPressMay 20, 2026
Medium4.9The Read More & Accordion plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.5.7.CVE-2026-7472 · CVE.org · NIST NVD · WordPressMay 20, 2026
High7.5The Creative Mail – Easier WordPress & WooCommerce Email Marketing plugin for WordPress is vulnerable to SQL Injection via the 'checkout_uuid' parameter in all version…CVE-2026-3985 · CVE.org · NIST NVD · WordPressMay 20, 2026