Updated 50 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

3,600 results · page 11 of 72

Jun 4, 2026WordPress Plugin Google Review Slider 6.1 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database qCVE-2019-25745 · WordPress plugins & themes · reported by VulnCheckHigh 8.8
WordPress Plugin Google Review Slider 6.1 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'tid' parameter. Attackers can send GET requests to the admin interface with malicious 'tid' values to extract sensitive database information using time-based blind SQL injection techniques.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org exploit-db.com
Jun 4, 2026The registration path /v1/account/register provides no bot mitigation mechanisms, allowing malicious automated systems to flood the database.CVE-2026-50225 · Other software · Acer · reported by 8fc372e3-d9c5-46e4-9410-38469745c639High 8.8
The registration path /v1/account/register provides no bot mitigation mechanisms, allowing malicious automated systems to flood the database.
Product
Connect M6E 5G Portable WiFi Router
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.acer.com
Jun 2, 2026Appsmith’s SQL query editor’s autocomplete functionality fails to sanitize database object names before rendering them in innerHTML, allowing an authenticated DCVE-2026-7299 · Other software · Appsmith · reported by cret@cert.orgMedium 6.3
Appsmith’s SQL query editor’s autocomplete functionality fails to sanitize database object names before rendering them in innerHTML, allowing an authenticated Developer to inject persistent XSS by a malicious table or column names triggering arbitrary code execution in the sessions of other workspace members when they interact with the same datasource.
Product
Appsmith
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 2, 2026LDAP filter injection vulnerability in Yandex Database prior to 25.3.1.25 allows a remote attacker with valid LDAP credentials to bypass group membership checksCVE-2026-10549 · Other software · Yandex · reported by browser-security@yandex-team.ruMedium 5.3
LDAP filter injection vulnerability in Yandex Database prior to 25.3.1.25 allows a remote attacker with valid LDAP credentials to bypass group membership checks resulting in unauthorized access to the database.
Product
Yandex Database
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ydb.tech
Jun 1, 2026In multiple functions, there is a possible way to access the contacts database due to a SQL injection.CVE-2026-0075 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.9
In multiple functions, there is a possible way to access the contacts database due to a SQL injection. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com
Jun 1, 2026Joomla Component JE Photo Gallery 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injectingCVE-2018-25433 · Websites & servers · reported by VulnCheckHigh 8.8
Joomla Component JE Photo Gallery 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting malicious SQL code through the categoryid parameter. Attackers can send GET requests to index.php with crafted categoryid values in the com_jephotogallery component to execute arbitrary SQL queries and retrieve sensitive data like usernames and password hashes.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record joomlaextensions.co.in joomlaextensions.co.in
Jun 1, 2026An improper Input Validation vulnerability in OTRS or ((OTRS)) Community Edition database layer module allows an unauthenticated SQL injection which can lead toCVE-2026-48188 · Other software · OTRS AG · reported by security@otrs.comCritical 9.1
An improper Input Validation vulnerability in OTRS or ((OTRS)) Community Edition database layer module allows an unauthenticated SQL injection which can lead to an authentication bypass. This issue only affects the system if the MySQL/MariaDB server is configured with the NO_BACKSLASH_ESCAPES SQL mode. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.4.X * (OTRS)) Community Edition: 6.0.x Products based on the ((OTRS)) Community Edition also very likely to be affected
Product
OTRS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record otrs.com
May 29, 2026agno 2.6.5 contains a SQL injection vulnerability in the ClickHouse vector database backend that allows attackers to inject arbitrary SQL expressions by supplyiCVE-2026-10105 · Other software · agno-agi · reported by VulnCheckHigh 8.7
agno 2.6.5 contains a SQL injection vulnerability in the ClickHouse vector database backend that allows attackers to inject arbitrary SQL expressions by supplying malicious metadata keys and values to the delete_by_metadata() method. Attackers can exploit the unsafe f-string interpolation in clickhousedb.py to delete all rows, target specific rows, or extract information through error-based or blind SQL injection techniques.
Product
agno
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 29, 2026HaPe PKH 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'desCVE-2018-25390 · Other software · Sitejo · reported by VulnCheckHigh 8.8
HaPe PKH 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'desa' POST parameter sent to lap-peserta-perdesa-pdf.php. Attackers can send a crafted request with a time-based blind payload to infer and extract sensitive database information.
Product
HaPe PKH
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sitejo.id sourceforge.net
May 29, 2026HaPe PKH 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'namCVE-2018-25389 · Other software · Sitejo · reported by VulnCheckHigh 8.8
HaPe PKH 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'nama_kelompok' POST parameter sent to lap-anggota-kelompok-pdf.php. Attackers can send a crafted request with a time-based blind payload to infer and extract sensitive database information.
Product
HaPe PKH
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sitejo.id sourceforge.net
May 29, 2026HaPe PKH 1.1 contains multiple SQL injection vulnerabilities in admin/media.php that allow attackers to manipulate database queries by injecting SQL code througCVE-2018-25386 · Other software · Sitejo · reported by VulnCheckHigh 8.8
HaPe PKH 1.1 contains multiple SQL injection vulnerabilities in admin/media.php that allow attackers to manipulate database queries by injecting SQL code through the 'id' parameter. An unauthenticated attacker can exploit the desa module (module=desa&act=hapus), while authenticated users can exploit the pengurus, fasilitas, and kelompok modules (for example act=print, act=editpengurus, act=editfasilitas, and act=editkelompok). Successful exploitation allows extraction of sensitive database information including the current user, database name, and DBMS version.
Product
HaPe PKH
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sitejo.id sourceforge.net
May 29, 2026Zechat 1.5 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through the unameCVE-2018-25382 · Other software · Bylancer · reported by VulnCheckHigh 8.8
Zechat 1.5 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through the uname parameter. Attackers can send crafted requests to profile.php with UNION-based SQL injection payloads to retrieve table names, column names, and sensitive data from the information_schema database.
Product
Zechat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bylancer.com bylancer.com
May 28, 2026Vulnerability in the Net Service component of Oracle Database Server.CVE-2026-46835 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.5
Vulnerability in the Net Service component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Net Service. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Net Service. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Product
Oracle Database Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
May 28, 2026Vulnerability in the Net Service component of Oracle Database Server.CVE-2026-46834 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.5
Vulnerability in the Net Service component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Net Service. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Net Service. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Product
Oracle Database Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
May 28, 2026Vulnerability in the Net Service component of Oracle Database Server.CVE-2026-46833 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9
Vulnerability in the Net Service component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Net Service. While the vulnerability is in Net Service, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Net Service. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).
Product
Oracle Database Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
May 28, 2026CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments.CVE-2026-44477 · Other software · cloudnative-pg · reported by GitHubCritical 9.4
CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.29.1 and 1.28.3, the CloudNativePG metrics exporter opens its PostgreSQL connection as the postgres superuser via the pod-local Unix socket, then demotes the session with SET ROLE pg_monitor. SET ROLE changes only current_user; session_user remains postgres. Any SQL expression evaluated inside the scrape session can invoke RESET ROLE to recover real superuser privileges, then use COPY ... TO PROGRAM to spawn an OS-level subprocess as the postgres user inside the primary pod. The READ ONLY transaction flag does not block this; it gates writes to database state, not external processes. This vulnerability is fixed in 1.29.1 and 1.28.3.
Product
cloudnative-pg
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 27, 2026Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790).CVE-2026-9739 · Computers, phones & browsers · Google · reported by cve-coordination@google.comCritical 9.4
Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790). During the beta phase, we implemented `allowed-origins` and `allowed-hosts` flags to align with MCP security guidelines. However, the hardcoded `Access-Control-Allow-Origin: *` header in the SSE initialization handler was inadvertently retained. This vulnerability specifically impacts users connecting via Toolbox using SSE under specification v2024-11-05.
Product
MCP Toolbox for Databases
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 27, 2026IBM Business Automation Workflow containers and traditional may leak information about its database structure in error messages.CVE-2026-1248 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Business Automation Workflow containers and traditional may leak information about its database structure in error messages.
Product
Business Automation Workflow containers and traditional
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com
May 27, 2026Islamic Database: Stored Cross-Site ScriptingCVE-2026-8845 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Islamic Database plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'islamicDB-roqya' shortcode in versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user-supplied 'width' and 'height' shortcode attributes within the islamicDB_sc_quran_qari_roqya() function, which are concatenated directly into HTML iframe attribute values. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Islamic Database
Affected
up to 1.0
What to do
Affects up to 1.0. Update Islamic Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 26, 2026Prometheus is an open-source monitoring system and time series database.CVE-2026-44903 · Other software · prometheus · reported by GitHubMedium 5.1
Prometheus is an open-source monitoring system and time series database. From 2.49.0 to before 3.5.3 and 3.11.3, in the Prometheus server's legacy web UI (enabled via the command-line flag --enable-feature=old-ui), the histogram heatmap chart view does not escape le label values when inserting them into the HTML for use as axis tick mark labels. An attacker who can inject crafted metrics can execute JavaScript in the browser of any Prometheus user who views the metric in the heatmap chart UI. This vulnerability is fixed in 3.5.3 and 3.11.3.
Product
prometheus
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 25, 2026Collectric CMU 1.0 contains a boolean-based blind SQL injection vulnerability in the lang parameter that allows unauthenticated attackers to manipulate databaseCVE-2018-25379 · Other software · Ourenergy · reported by VulnCheckHigh 8.8
Collectric CMU 1.0 contains a boolean-based blind SQL injection vulnerability in the lang parameter that allows unauthenticated attackers to manipulate database queries during authentication. Attackers can inject SQL code through the lang parameter in login requests to extract sensitive information from the database using time-based blind techniques.
Product
Collectric CMU
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ourenergy.se exploit-db.com
May 25, 2026mooSocial Store Plugin 2.6 contains a blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries through the productCVE-2018-25371 · Other software · Moosocial · reported by VulnCheckHigh 8.8
mooSocial Store Plugin 2.6 contains a blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries through the product parameter in URL rewrite functionality. Attackers can inject SQL code using boolean-based blind, time-based blind, or stacked query techniques in the product URI parameter to extract sensitive database information.
Product
mooSocial Store Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record addons.moosocial.com moosocial.com
May 25, 2026Twitter-Clone 1 contains a SQL injection vulnerability in follow.php that allows attackers to manipulate database queries by injecting SQL code through the userCVE-2018-25362 · Other software · Fyffe · reported by VulnCheckHigh 8.8
Twitter-Clone 1 contains a SQL injection vulnerability in follow.php that allows attackers to manipulate database queries by injecting SQL code through the userid parameter. Attackers can submit union-based or time-based blind SQL injection payloads to extract sensitive database information including usernames, passwords, and database credentials.
Product
PHP-Twitter-Clone
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com exploit-db.com
May 23, 2026Joomla! Component Ek Rishta 2.10 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL cCVE-2018-25348 · Websites & servers · reported by VulnCheckHigh 8.8
Joomla! Component Ek Rishta 2.10 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the cid parameter. Attackers can send GET requests to the user_detail view with malicious cid values containing SQL commands to extract sensitive database information.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record extensions.joomla.org exploit-db.com
May 23, 2026WordPress Contact Form Maker Plugin 1.12.20 contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries through theCVE-2018-25347 · WordPress plugins & themes · reported by VulnCheckHigh 7.1
WordPress Contact Form Maker Plugin 1.12.20 contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries through the FormMakerSQLMapping and generete_csv_fmc AJAX actions. Attackers can inject malicious SQL code via the 'name' and 'search_labels' parameters to extract sensitive database information or escalate privileges.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org exploit-db.com
May 23, 2026WordPress Form Maker Plugin 1.12.24 and below contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries by injectCVE-2018-25346 · WordPress plugins & themes · reported by VulnCheckHigh 7.1
WordPress Form Maker Plugin 1.12.24 and below contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries by injecting SQL code through the FormMakerSQLMapping and generete_csv actions. Attackers can submit POST requests with malicious SQL payloads in the name and search_labels parameters to extract, modify, or escalate privileges within the WordPress database.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record exploit-db.com vulncheck.com
May 23, 2026Smartshop 1 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code tCVE-2018-25342 · Other software · Behance · reported by VulnCheckHigh 8.8
Smartshop 1 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'searched' parameter in search.php. Attackers can send GET requests with malicious SQL payloads like SLEEP commands to extract sensitive database information including product details and system data.
Product
Smartshop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com behance.net
May 21, 2026Open ISES Tickets before 3.44.2 contains hardcoded MySQL database connection credentials (host, username, password, database name) in import_mdb.php.CVE-2026-48242 · Other software · Open ISES · reported by VulnCheckCritical 9.2
Open ISES Tickets before 3.44.2 contains hardcoded MySQL database connection credentials (host, username, password, database name) in import_mdb.php. The credentials are embedded in source code committed to the public repository, allowing any reader of the source to obtain valid configuration values that may match deployed installations.
Product
Tickets
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 21, 2026Open ISES Tickets before 3.44.2 contains hardcoded MySQL database credentials in loader.php (a public-facing database utility) that are committed to the source CVE-2026-48241 · Other software · Open ISES · reported by VulnCheckCritical 9.2
Open ISES Tickets before 3.44.2 contains hardcoded MySQL database credentials in loader.php (a public-facing database utility) that are committed to the source repository. Any actor with access to the public source tree (or an unauthenticated attacker with read access to the file on a deployed installation) can read the username, password, and database name and use them to connect to the database if it is reachable from their network.
Product
Tickets
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 20, 2026The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without adequate validation.CVE-2026-9100 · Other software · MongoDB, Inc. · reported by cna@mongodb.comMedium 6
The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without adequate validation. Crafted documents in a GridFS collection may cause any application that reads those files via the legacy API to either crash (via a division-by-zero) or silently leak process memory contents (via an out-of-bounds read).
Product
C Driver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.mongodb.org
May 20, 2026In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by sasl_server_userdb_checkCVE-2026-47784 · Other software · memcached · reported by MITREHigh 8.1
In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by sasl_server_userdb_checkpass.
Product
memcached
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 20, 2026In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username iCVE-2026-47783 · Other software · memcached · reported by MITREHigh 8.1
In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by sasl_server_userdb_checkpass.
Product
memcached
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 20, 2026Advanced Database Cleaner – Premium: Local File InclusionCVE-2026-7522 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Advanced Database Cleaner – Premium plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.1.0 via the 'template' parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Product
Advanced Database Cleaner – Premium
Affected
up to 4.1.0
What to do
Affects up to 4.1.0. Update Advanced Database Cleaner – Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record docs.sigmaplugin.com sigmaplugin.com
May 19, 2026Sparx Pro Cloud Server is vulnerable to Broken Access Control within communication with the database.CVE-2026-42096 · Other software · Sparx Systems · reported by cvd@cert.plHigh 8.7
Sparx Pro Cloud Server is vulnerable to Broken Access Control within communication with the database. Due to lack of permission checks, any low privileged user can run arbitrary SQL queries within database user context. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.1 (build 167) and below were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
Product
Pro Cloud Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl efigo.pl
May 19, 2026The AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing user input, leading to SQL Injection.CVE-2026-8827 · Other software · TYPO3 · reported by f4fb688c-4412-4426-b4b8-421ecf27b14aHigh 8.2
The AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing user input, leading to SQL Injection. The method is not invoked anywhere within the extension itself and therefore poses no direct risk in a default installation. However, custom extensions that call this method with untrusted input would expose the site to SQL injection.
Product
Extension "Address List"
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record typo3.org
May 19, 2026The extension fails to properly sanitize user input before using it in a database query.CVE-2026-8726 · Other software · TYPO3 · reported by f4fb688c-4412-4426-b4b8-421ecf27b14aHigh 8.2
The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the "Date Menu of news articles" plugin. Exploitation requires the "Date Menu of news articles" plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled.
Product
Extension "News system"
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record typo3.org
May 17, 2026Zechat 1.5 contains a SQL injection vulnerability in the v parameter that allows unauthenticated attackers to extract database information using time-based blinCVE-2018-25339 · Other software · Bylancer · reported by VulnCheckHigh 8.8
Zechat 1.5 contains a SQL injection vulnerability in the v parameter that allows unauthenticated attackers to extract database information using time-based blind techniques. Attackers can exploit the v parameter with sleep-based blind injection to confirm vulnerability and extract data.
Product
Zechat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bylancer.com exploit-db.com
May 17, 2026Zechat 1.5 contains a SQL injection vulnerability in the hashtag parameter that allows unauthenticated attackers to extract database information using union-basCVE-2018-25338 · Other software · Bylancer · reported by VulnCheckHigh 8.8
Zechat 1.5 contains a SQL injection vulnerability in the hashtag parameter that allows unauthenticated attackers to extract database information using union-based techniques. Attackers can exploit the hashtag parameter with union-based payloads to retrieve table and column names.
Product
Zechat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bylancer.com exploit-db.com
May 17, 2026Redaxo CMS Addon MyEvents 2.2.1 contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL codeCVE-2018-25319 · Other software · wende60 · reported by VulnCheckHigh 7.1
Redaxo CMS Addon MyEvents 2.2.1 contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the myevents_id parameter. Attackers can send GET requests to the event_add.php page with malicious myevents_id values to extract or modify sensitive database information.
Product
Redaxo CMS Addon MyEvents
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com exploit-db.com
May 16, 2026Fuel CMS 1.4.13 contains a blind SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through thCVE-2021-47980 · Other software · Getfuelcms · reported by VulnCheckHigh 7.1
Fuel CMS 1.4.13 contains a blind SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'col' parameter in the Activity Log interface. Attackers can send requests to the logs endpoint with malicious SQL payloads in the 'col' parameter to extract database information based on response time delays.
Product
Fuel CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com exploit-db.com
May 16, 2026EgavilanMedia PHPCRUD 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code thrCVE-2021-47956 · Other software · Egavilanmedia · reported by VulnCheckHigh 8.8
EgavilanMedia PHPCRUD 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the firstname parameter. Attackers can send POST requests to insert.php with malicious firstname values to extract sensitive database information.
Product
EgavilanMedia PHPCRUD
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record egavilanmedia.com egavilanmedia.com
May 16, 2026LayerBB 1.1.4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the seaCVE-2021-47954 · Other software · LayerBB · reported by VulnCheckHigh 8.8
LayerBB 1.1.4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the search_query parameter. Attackers can send POST requests to /search.php with malicious search_query values using CASE WHEN statements to extract sensitive database information.
Product
LayerBB
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com vulncheck.com
May 15, 2026Mathesar is a web application that makes working with PostgreSQL databases both simple and powerful.CVE-2026-44719 · Other software · mathesar-foundation · reported by GitHubMedium 5.3
Mathesar is a web application that makes working with PostgreSQL databases both simple and powerful. From 0.2.0 to before 0.10.0, collaborators.list, tables.metadata.list, explorations.list, and forms.list accept a database_id without verifying that the requesting user was a collaborator on that database. An authenticated user on the same Mathesar installation could use these methods to view Mathesar-managed metadata for databases where they were not a collaborator. Depending on the database and features in use, exposed metadata could include collaborator mappings, table metadata, saved exploration metadata, and form metadata. For forms, the exposed metadata included form tokens. For public forms, possession of the token is equivalent to possession of the public form link, which allows submission to the form under the form’s configured PostgreSQL role. This vulnerability is fixed in 0.10.0.
Product
mathesar
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
May 15, 2026Mathesar is a web application that makes working with PostgreSQL databases both simple and powerful.CVE-2026-44718 · Other software · mathesar-foundation · reported by GitHubMedium 5.3
Mathesar is a web application that makes working with PostgreSQL databases both simple and powerful. From 0.2.0 to before 0.10.0, explorations.get, explorations.replace, and explorations.delete operate on an exploration_id without verifying that the requesting user was a collaborator on the exploration’s database. An authenticated user on the same Mathesar installation who knew or guessed an exploration ID could read, replace, or delete a saved exploration belonging to a database where they were not a collaborator. This affected Mathesar-managed saved exploration definitions, including names, descriptions, selected columns, display metadata, filters, sorting, and transformations. This vulnerability is fixed in 0.10.0.
Product
mathesar
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
May 14, 2026Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as the operating system user running the dataCVE-2026-6637 · Other software · Postgresql · reported by f86ef6dc-4d3a-42ad-8f28-e6d5547a5007High 8.8
Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as the operating system user running the database. A distinct attack is possible if the application declares a user-controlled column as a "refint" cascade primary key and facilitates user-controlled updates to that column. In that case, a SQL injection allows a primary key update value provider to execute arbitrary SQL as the database user performing the primary key update. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
Product
Postgresql
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record postgresql.org
May 14, 2026Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bCVE-2026-6473 · Other software · Red Hat · reported by f86ef6dc-4d3a-42ad-8f28-e6d5547a5007High 8.8
Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds. This may execute arbitrary code as the operating system user running the database. In applications that pass gigabyte-scale user inputs to the relevant database functions, the application input provider may achieve a segmentation fault. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
Product
Red Hat Enterprise Linux 10
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record postgresql.org access.redhat.com
May 14, 2026Database Backup for: Authorization bypassCVE-2026-4031 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Database Backup for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.2. This is due to the plugin not restricting access to the wp_db_temp_dir parameter, which controls where database backups are written. This makes it possible for unauthenticated attackers to send a request to wp-cron.php with a poisoned wp_db_temp_dir value pointing to a publicly accessible directory (e.g., wp-content/uploads/), and if a scheduled backup is due, intercept the backup file before it is cleaned up. The backup file has a predictable name based on the database name, table prefix, date, and Swatch Internet Time, making interception reliable. Successful exploitation leads to Sensitive Information Exposure including database credentials, user password hashes, and personally identifiable information. This vulnerability requires that the site administrator has configured scheduled backups.
Product
Database Backup for
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update Database Backup for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 14, 2026Database Backup for: Unauthorized arbitrary file read and deletionCVE-2026-4030 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Database Backup for WordPress plugin for WordPress is vulnerable to unauthorized arbitrary file read and deletion in all versions up to, and including, 2.5.2. This is due to the plugin not properly enforcing the return value of its authorization check combined with a user-controlled backup directory parameter. This makes it possible for unauthenticated attackers to read and delete arbitrary files on the server, leading to Sensitive Information Exposure and potential site takeover. Note: This vulnerability is only exploitable in WordPress Multisite environments where the deprecated is_site_admin() function exists.
Product
Database Backup for
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update Database Backup for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 14, 2026Database Backup for: Unauthorized database exportCVE-2026-4029 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Database Backup for WordPress plugin for WordPress is vulnerable to unauthorized database export in all versions up to, and including, 2.5.2. This is due to the plugin not properly enforcing the return value of its authorization check. This makes it possible for unauthenticated attackers to export database tables, leading to Sensitive Information Exposure. Note: This vulnerability is only exploitable in WordPress Multisite environments where the deprecated is_site_admin() function exists.
Product
Database Backup for
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update Database Backup for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 14, 2026Comarch ERP Optima client makes use of a hard-coded password for a database user.CVE-2025-68421 · Other software · Comarch · reported by cvd@cert.plHigh 8.7
Comarch ERP Optima client makes use of a hard-coded password for a database user. These credentials cannot be changed. It is possible for a remote attacker to gain an access to the database with elevated privileges including executing system commands on a server. This issue has been fixed in version 2026.4
Product
ERP Optima
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl comarch.pl

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.