Total
20017 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-10736 | 2026-06-18 | N/A | 4.9 MEDIUM | ||
| The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'data' parameter in all versions up to, and including, 3.9.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | |||||
| CVE-2026-11360 | 2026-06-18 | N/A | 4.9 MEDIUM | ||
| The Advanced Order Export For WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'sort_direction' parameter in all versions up to, and including, 4.0.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with shop manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The endpoint requires a valid woe_nonce and Shop Manager-level capabilities (view_woocommerce_reports or export_woocommerce_orders), and wp_magic_quotes protection is stripped via stripslashes_deep() before processing, allowing quote and backslash characters to survive intact into the SQL context. | |||||
| CVE-2026-54818 | 2026-06-17 | N/A | 8.5 HIGH | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VeronaLabs Slimstat Analytics allows Blind SQL Injection. This issue affects Slimstat Analytics: from n/a through 5.4.11. | |||||
| CVE-2026-54812 | 2026-06-17 | N/A | 9.3 CRITICAL | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Motors allows Blind SQL Injection. This issue affects Motors: from n/a through 1.4.109. | |||||
| CVE-2026-54809 | 2026-06-17 | N/A | 9.3 CRITICAL | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VillaTheme GIFT4U allows Blind SQL Injection. This issue affects GIFT4U: from n/a through 1.0.10. | |||||
| CVE-2026-54185 | 2026-06-17 | N/A | 8.5 HIGH | ||
| Subscriber SQL Injection in Cornerstone < 7.8.8 versions. | |||||
| CVE-2026-49084 | 2026-06-17 | N/A | 9.3 CRITICAL | ||
| Unauthenticated SQL Injection in JetEngine < 3.8.9.1 versions. | |||||
| CVE-2026-49076 | 2026-06-17 | N/A | 9.3 CRITICAL | ||
| Unauthenticated SQL Injection in JetEngine <= 3.8.9.1 versions. | |||||
| CVE-2026-48967 | 2026-06-17 | N/A | 8.5 HIGH | ||
| Subscriber SQL Injection in Geo Mashup <= 1.13.19 versions. | |||||
| CVE-2026-22332 | 2026-06-17 | N/A | 9.3 CRITICAL | ||
| Unauthenticated SQL Injection in Tutor LMS Pro <= 3.9.6 versions. | |||||
| CVE-2025-59554 | 2026-06-17 | N/A | 9.3 CRITICAL | ||
| Unauthenticated SQL Injection in Advanced Ads – Tracking < 3.0.7 versions. | |||||
| CVE-2026-28576 | 1 Google | 1 Android | 2026-06-17 | N/A | 5.5 MEDIUM |
| In Contacts Provider, there is a possible way to access the contacts database due to SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2025-57819 | 1 Sangoma | 1 Freepbx | 2026-06-17 | N/A | 9.8 CRITICAL |
| FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3. | |||||
| CVE-2026-54819 | 2026-06-17 | N/A | 9.3 CRITICAL | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Webilia Inc. Listdom allows Blind SQL Injection. This issue affects Listdom: from n/a through 5.4.0. | |||||
| CVE-2026-54815 | 2026-06-17 | N/A | 9.3 CRITICAL | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cargo RD Cargo Shipping Location for WooCommerce allows Blind SQL Injection. This issue affects Cargo Shipping Location for WooCommerce: from n/a through 5.6. | |||||
| CVE-2026-54813 | 2026-06-17 | N/A | 8.5 HIGH | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brainstorm Force SureDash allows Blind SQL Injection. This issue affects SureDash: from n/a through 1.8.0. | |||||
| CVE-2026-54811 | 2026-06-17 | N/A | 9.3 CRITICAL | ||
| Unauthenticated SQL Injection in WP eMember < v10.9.4 versions. | |||||
| CVE-2026-54808 | 2026-06-17 | N/A | 9.3 CRITICAL | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel WP Travel Gutenberg Blocks allows Blind SQL Injection. This issue affects WP Travel Gutenberg Blocks: from n/a through 3.9.4. | |||||
| CVE-2026-54187 | 2026-06-17 | N/A | 9.3 CRITICAL | ||
| Unauthenticated SQL Injection in JetEngine <= 3.8.10.1 versions. | |||||
| CVE-2026-22335 | 2026-06-17 | N/A | 8.5 HIGH | ||
| Subscriber SQL Injection in WooCommerce Frontend Manager – Ultimate < 6.7.7 versions. | |||||