CVE Intelligence
Início / CVEs

Base de CVEs

Vulnerabilidades publicadas, com severidade, exploração conhecida e fontes oficiais.

Severidade
Limpar

3.591 resultado(s)

Exportar esta busca: RSS · CSV · STIX
CVE-2026-42417 Crítica · 9.3 CWE-89 06/10/2026
WordPress ARMember Premium plugin <= 7.8 - SQL Injection vulnerability
Unauthenticated SQL Injection in ARMember Premium <= 7.8 versions.
CVE-2026-42416 Alta · 8.5 CWE-89 06/10/2026
WordPress UDesign Core plugin <= 4.15.0 - SQL Injection vulnerability
Subscriber SQL Injection in UDesign Core <= 4.15.0 versions.
CVE-2026-42415 Crítica · 9.3 CWE-89 06/10/2026
WordPress Porto Theme - Functionality plugin <= 3.9.3 - SQL Injection vulnerability
Unauthenticated SQL Injection in Porto Theme - Functionality <= 3.9.3 versions.
CVE-2026-42414 Alta · 8.5 CWE-89 06/10/2026
WordPress ListingPro plugin <= 2.9.12 - SQL Injection vulnerability
Subscriber SQL Injection in ListingPro <= 2.9.12 versions.
CVE-2026-41555 Crítica · 9.3 CWE-89 06/10/2026
WordPress Newsletter Subscription Form – User Subscriptions Form, Capture Email plugin <= 1.5.9 - SQL Injection vulnerability
Unauthenticated SQL Injection in Newsletter Subscription Form – User Subscriptions Form, Capture Email <= 1.5.9 versions.
CVE-2026-39795 Crítica · 9.3 CWE-89 06/10/2026
WordPress SendPress Newsletters plugin <= 1.26.1.20 - SQL Injection vulnerability
Unauthenticated SQL Injection in SendPress Newsletters <= 1.26.1.20 versions.
CVE-2026-39785 Crítica · 9.3 CWE-89 06/10/2026
WordPress Gmedia Photo Gallery plugin <= 1.25.1 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Serhii Pasyuk Gmedia Photo Gallery grand-media allows Blind SQL Injection.This issue affects Gmedia Photo Gallery: from n/a through 1.25.1.
CVE-2026-39771 Alta · 8.5 CWE-89 06/10/2026
WordPress Buddyboss Platform plugin <= 3.1.0 - SQL Injection vulnerability
Subscriber SQL Injection in Buddyboss Platform <= 3.1.0 versions.
CVE-2026-39764 Crítica · 9.3 CWE-89 06/10/2026
WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.19 - SQL Injection vulnerability
Unauthenticated SQL Injection in Radius Booking — Booking Calendar for Appointments &amp; Services <= 1.0.19 versions.
CVE-2026-39747 Alta · 8.5 CWE-89 06/10/2026
WordPress Woffice theme <= 5.4.35 - SQL Injection vulnerability
Subscriber SQL Injection in Woffice <= 5.4.35 versions.
CVE-2026-39746 Crítica · 9.3 CWE-89 06/10/2026
WordPress Booknetic plugin <= 4.8.5 - SQL Injection vulnerability
Unauthenticated SQL Injection in Booknetic <= 4.8.5 versions.
CVE-2026-32581 Alta · 7.1 CWE-89 06/10/2026
WordPress Mooberry Book Manager plugin 4.16.2 - SQL Injection vulnerability
Subscriber SQL Injection in Mooberry Book Manager 4.16.2 versions.
CVE-2026-32580 Alta · 7.5 CWE-89 06/10/2026
WordPress WooCommerce Lottery plugin <= 2.2.9 - SQL Injection vulnerability
Unauthenticated SQL Injection in WooCommerce Lottery <= 2.2.9 versions.
CVE-2026-32557 Crítica · 9.3 CWE-89 06/10/2026
WordPress WooCommerce Appointments plugin <= 5.3.2 - SQL Injection vulnerability
Unauthenticated SQL Injection in WooCommerce Appointments <= 5.3.2 versions.
CVE-2026-25434 Alta · 8.5 CWE-89 06/10/2026
WordPress WP2LEADS plugin <= 3.5.7 - SQL Injection vulnerability
Subscriber SQL Injection in WP2LEADS <= 3.5.7 versions.
CVE-2026-105317 Alta · 8.5 CWE-89 06/10/2026
WordPress Paid Member Subscriptions plugin <= 3.1.1 - SQL Injection vulnerability
Subscriber SQL Injection in Paid Member Subscriptions <= 3.1.1 versions.
CVE-2026-71298 Média · 6.4 CWE-89 05/10/2026
Maestro: sql identifier injection via properties.* search filter and orderby field
A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the `orderBy` query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extraction of data from the database.
CVE-2026-103066 Alta · 8.5 CWE-89 05/10/2026
WordPress WP BASE Booking plugin <= 6.4.0 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL Injection.This issue affects WP BASE Booking: from n/a through 6.4.0.
CVE-2026-88424 Crítica · 9.8 CWE-89 05/10/2026
FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the…
FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter(). This vulnerability allows attackers to access sensitive database information via crafted SQL statements.
CVE-2026-103352 Crítica · 9.3 CWE-89 05/10/2026
WordPress WP BASE Booking plugin <= 6.4.0 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL Injection.This issue affects WP BASE Booking: from n/a through 6.4.0.
CVE-2026-88397 Média · 6.5 CWE-89 05/10/2026
ApiAdmin v.5.0 and before is vulnerable to SQL Injection in the user-list endpoint GET…
ApiAdmin v.5.0 and before is vulnerable to SQL Injection in the user-list endpoint GET /admin/User/getUsers via the gid parameter.
CVE-2026-88395 Crítica · 9.8 CWE-89 05/10/2026
GouGuOA v6.0.5 and before is vulnerable to SQL Injection in /home/message/rubbish via…
GouGuOA v6.0.5 and before is vulnerable to SQL Injection in /home/message/rubbish via the keywords parameter.
CVE-2026-102428 Crítica · 9.8 CWE-89 05/10/2026
Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16
Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16 - The order column for records was user provided and not properly validated, leading to a SQL injection vector.
CVE-2026-104408 Alta · 7.6 CWE-89 05/10/2026
WordPress Groundhogg plugin <= 4.8.3 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Groundhogg Groundhogg groundhogg allows Blind SQL Injection.This issue affects Groundhogg: from n/a through 4.8.3.
CVE-2026-104389 Alta · 8.5 CWE-89 05/10/2026
WordPress Sirv plugin <= 8.2.5 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sirv Sirv sirv allows Blind SQL Injection.This issue affects Sirv: from n/a through 8.2.5.