Catalog

Findings

Filter the merged record by severity, source, stack, and weakness type.

SearchSeveritySourceStackWeaknessSort

Known exploited only

Reset

High8.8BillaBear (all versions prior to Jan 2026) contains a SQL Injection vulnerability in the EventRepository.CVE-2026-31069 · CVE.org · NIST NVDMay 19, 2026
High7.5The Contest Gallery plugin for WordPress is vulnerable to SQL Injection via the 'form_input' parameter in versions up to, and including, 28.1.6.CVE-2026-8912 · CVE.org · NIST NVD · WordPressMay 19, 2026
High8.2The AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing user input, leading to SQL Injection.CVE-2026-8827 · CVE.org · NIST NVDMay 19, 2026
High8.2The extension fails to properly sanitize user input before using it in a database query.CVE-2026-8726 · CVE.org · NIST NVDMay 19, 2026
High8.6SOGo versions 5.12.7 and prior contains a SQL injection vulnerability in the Access Control List management functionality that allows authenticated users to extract ar…CVE-2026-8851 · CVE.org · NIST NVDMay 18, 2026
High8.6The WP Photo Album Plus WordPress plugin before 9.1.11.001 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated u…CVE-2026-6379 · CVE.org · NIST NVD · WordPressMay 18, 2026
Medium5.5A flaw has been found in projectworlds hospital-management-system-in-php 1.0.CVE-2026-8785 · CVE.org · NIST NVD · PHPMay 18, 2026
Low2.0A weakness has been identified in linlinjava litemall up to 1.8.0.CVE-2026-8772 · CVE.org · NIST NVDMay 18, 2026
Medium5.5A security flaw has been discovered in linlinjava litemall up to 1.8.0.CVE-2026-8771 · CVE.org · NIST NVDMay 18, 2026
High8.8Zechat 1.5 contains a SQL injection vulnerability in the v parameter that allows unauthenticated attackers to extract database information using time-based blind techniques.CVE-2018-25339 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.3%May 17, 2026
High8.8Zechat 1.5 contains a SQL injection vulnerability in the hashtag parameter that allows unauthenticated attackers to extract database information using union-based techniques.CVE-2018-25338 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.3%May 17, 2026
High8.8Nordex N149/4.0-4.5 Wind Turbine Web Server 4.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injec…CVE-2018-25333 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.3%May 17, 2026
High8.8Joomla! extension EkRishta 2.10 contains persistent cross-site scripting and SQL injection vulnerabilities that allow attackers to inject malicious code through profil…CVE-2018-25330 · CVE.org · FIRST EPSS · NIST NVD · JoomlaEPSS 0.3%May 17, 2026
High7.1Redaxo CMS Addon MyEvents 2.2.1 contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code throug…CVE-2018-25319 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.3%May 17, 2026
Medium5.5A vulnerability was determined in Oinone Pamirs up to 7.2.0.CVE-2026-8734 · CVE.org · NIST NVDMay 17, 2026
Low2.0A security flaw has been discovered in Dataease 2.10.20.CVE-2026-8724 · dataease · dataease · CVE.org · NIST NVDMay 17, 2026
High7.1Fuel CMS 1.4.13 contains a blind SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'col'…CVE-2021-47980 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.2%May 16, 2026
High8.8EgavilanMedia PHPCRUD 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through th…CVE-2021-47956 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.3%May 16, 2026
High8.8LayerBB 1.1.4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the search_query parameter.CVE-2021-47954 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.2%May 16, 2026
High8.8Supsystic Membership 1.4.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code t…CVE-2020-37244 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.3%May 16, 2026
High8.8Supsystic Pricing Table 1.8.7 contains an SQL injection vulnerability in the 'sidx' GET parameter that allows unauthenticated attackers to execute arbitrary SQL querie…CVE-2020-37243 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.3%May 16, 2026
High8.8Supsystic Ultimate Maps 1.1.12 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious co…CVE-2020-37242 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.3%May 16, 2026
Critical9.3phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() methods that inte…CVE-2026-46364 · CVE.org · NIST NVDMay 15, 2026
High7.7phpMyFAQ before 4.1.2 contains a sql injection vulnerability in CurrentUser::setTokenData that allows authenticated attackers to execute arbitrary SQL by injecting mal…CVE-2026-46359 · CVE.org · NIST NVDMay 15, 2026
High8.7Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores.CVE-2026-45800 · CVE.org · NIST NVDMay 15, 2026