The JetFormBuilder WordPress plugin before 3.6.5.2 does not sanitize a request parameter before rendering it as message content, allowing unauthenticated users to execute arbitrary shortcodes registered on the site on any page displaying a form. Escaping is applied to that content before a later shortcode-expansion pass rather than after it, so the escaping can be bypassed.
A vulnerability was found in SourceCodester Online Voting System 1.0. The impacted element is an unknown function of the file /ajax.php?action=delete_category. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
A vulnerability was detected in code-projects Doctor Appointment System 1.0. This vulnerability affects unknown code of the file /patient/booking.php. The manipulation of the argument doc_id results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.
CVE-2026-85397 is a SQL injection vulnerability in version 1.0 of the code-projects Hospital Information System. The flaw exists in the findBySearch function within the addReq.php file, where manipulation of the Search argument allows remote attackers to perform SQL injection. The vulnerability has been publicly disclosed, but no official patch is currently available.
CVE-2026-85225 is a SQL injection vulnerability in version 1.0 of the code-projects Doctor Appointment System. The flaw exists in the /patient_login.php file where the email parameter can be manipulated to perform SQL injection. This vulnerability can be exploited remotely without authentication. No official patch or fix information is provided. The vulnerability has a medium severity rating with a CVSS score of 6.9.
The Brave WordPress plugin before 0.8.8 does not prevent a URL parameter used to pre-fill a form field from being passed to WordPress's shortcode engine, allowing unauthenticated attackers to have arbitrary shortcodes registered on the site executed server-side.
The GutenKit WordPress plugin before 2.5.1 does not validate or escape style settings saved against a post before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into pages served to other users and to anonymous visitors. JavaScript execution is not possible at that role, so the impact is limited to defacement, interface redressing and forcing external resources to load.
The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level access. This allows such users to inject arbitrary newline-delimited Apache directives into the root .htaccess file. On Apache servers that honour PHP directives, the injection can be chained with the user's own media upload (a polyglot image carrying a PHP payload) and an auto_prepend_file directive to achieve Remote Code Execution.
In Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command by substituting placeholder values (e.g. {{ header:device_id }}) resolved from inbound message headers into a pre-configured JSON "thing" template as raw, un-escaped strings, and then parses the resulting string as JSON. Because the placeholder engine performs no JSON escaping and is unaware of the surrounding JSON string context, a resolved value containing a double-quote character can break out of its string and inject additional JSON structure.
When a connection is configured to use this mapper with a template that reflects a header whose value a publishing device can control (for example an MQTT 5 user property, an AMQP 1.0 application property, or a Kafka record header), an attacker able to publish on that connection can inject an inline _policy object. The inline policy overrides the administrator-configured policyId, letting the attacker assign an arbitrary access-control policy to the newly created digital twin — gaining full read/write access to it and potentially revoking the legitimate owner's access, with no administrator interaction.
Exploitation requires all of the following: the connection uses the (non-default) ImplicitThingCreation mapper; its template reflects an attacker-controllable header; and, for the policy-override impact, the connection's authorization subjects are permitted to create policies (the default). Deployments that restrict the connection's subjects to thing creation only via the entity-creation configuration are not affected by the policy-override impact.
The MW WP Form WordPress plugin before 5.1.5 does not prevent shortcodes in user-submitted values from being executed when it merges those values into a message that it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site. Exploitation requires the site to have been configured to echo a submitted value back to the visitor after submission.
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos allows authenticated users to inject arbitrary iCalendar properties and events into their exported .ics feed by embedding raw CRLF sequences in subscription names or notes. Because the input validation layer only encodes HTML metacharacters but never strips newlines, and the export layer decodes those entities back before writing iCal output, an attacker with any valid account can craft a subscription whose name breaks out of the current VEVENT block and inserts fully attacker-controlled calendar events — including spoofed organizers, arbitrary email addresses in ATTENDEE properties, and misleading event content — into any calendar application subscribed to that feed. This issue has been patched in version 5.0.0.
CVE-2026-82701 is a SQL injection vulnerability in the code-projects Online Shopping System version 1.0. The flaw exists in the /action.php file within the Search Functionality component, where manipulation of the 'keyword' argument allows remote attackers to perform SQL injection. The vulnerability has a medium severity score of 6.9 and has been publicly disclosed, but no official patch or fix is currently available.
CVE-2026-82609 is a medium severity SQL injection vulnerability in itsourcecode Sales and Inventory System version 1.0. The flaw exists in the /pages/inv_edit.php file where manipulation of the ID parameter allows remote attackers to perform SQL injection. Exploit code is publicly available, but there are no known exploits in the wild. No official patch or remediation has been provided yet.
CVE-2026-82545 is a SQL injection vulnerability in itsourcecode Sales and Inventory System version 1.0. The flaw exists in an unknown function within the /pages/sup_searchfrm.php file, where manipulation of the ID argument allows injection of SQL commands. This vulnerability can be exploited remotely without user interaction. Public exploit code has been disclosed. The vulnerability has a medium severity rating with a CVSS score of 5.3.
A SQL injection vulnerability exists in itsourcecode Sales and Inventory System 1.0 in the /pages/pro_edit.php file via manipulation of the ID argument. This vulnerability can be exploited remotely and has been publicly disclosed. No official patch or fix is currently available. The CVSS v3.1 base score is 6.3, indicating a medium severity level.
A SQL injection vulnerability exists in itsourcecode Sales and Inventory System 1.0, specifically in the processing of the /pages/emp_edit.php file via the ID parameter. This vulnerability allows remote attackers with low privileges to manipulate the ID argument, potentially impacting confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 base score of 6.3, indicating a medium severity level. No official patch or remediation has been provided yet. Exploit code is publicly available, but there are no confirmed reports of exploitation in the wild.
Tutor LMS plugin for WordPress up to version 4.0.5 contains a vulnerability allowing unauthenticated remote code execution via the tutor_course_filter_ajax AJAX action. This occurs due to missing authorization and unsanitized input passed to extract(), enabling attackers to invoke arbitrary zero-argument PHP functions. The flaw also allows creation of persistent subscriber-level accounts via WordPress core edit_user().
CVE-2026-81523 is a low-severity vulnerability in MongoDB's libmongocrypt library version 1.0.0 through before 1.20.3. It involves improper neutralization of special elements in output used by a downstream component, specifically due to missing input validation in the automatic-encryption context setup. This allows a caller-supplied database identifier to be accepted without sanitization, potentially leading to incorrect schema selection and limited disclosure or modification of application-handled information.
CVE-2026-81526 is a high-severity vulnerability in the MongoDB Rust Driver version 3.0.0 where special characters in a caller-supplied target identifier are not properly neutralized before being sent to the server. This flaw allows an attacker who can control the target identifier to cause write operations to affect unintended targets within the same deployment, potentially modifying data across logical boundaries enforced by the application.
CVE-2026-19092 is a critical vulnerability in the Tutor LMS WordPress plugin version 2.1.3. It allows unauthenticated users to overwrite internal variables during template rendering, enabling them to invoke arbitrary zero-argument PHP functions and obtain their output. This flaw arises from improper neutralization of special elements in output used by a downstream component, classified as CWE-74.