tag

Cwe-89

wp2shell — WordPress Core Pre-Auth SQLi → Row Forgery → Admin Creation → RCE (CVE-2026-63030 + CVE-2026-60137) KEV EPSS 97%

CVE-2026-63030 (REST /batch/v1 route confusion, CVSS 7.5), CVE-2026-60137 (author__not_in SQL injection, CVSS 9.1); GHSA-ff9f-jf42-662q, GHSA-fpp7-x2x2-2mjf web Patched

CVE-2026-63030webCRITICAL 9.1Patched2026-07-19LiteLLM Proxy Pre-Authentication SQL Injection via Error-Handling Callback (CVE-2026-42208) KEV EPSS 89%

CVE-2026-42208 (GHSA-r75f-5x8p-qvmc) web Patched

CVE-2026-42208webCRITICAL 9.8Patched2026-07-11PPOM for WooCommerce <= 33.0.15 - Unauthenticated Time-Based Blind SQL Injection (CVE-2025-11391)

CVE-2025-11391 web Patched

CVE-2025-11391webCRITICAL 9.8Patched2026-07-06FreePBX Unauthenticated SQL Injection to RCE (CVE-2025-57819) KEV EPSS 88%

CVE-2025-57819 web Patched

CVE-2025-57819webCRITICAL 9.8Patched2026-07-06Django QuerySet/Q Object SQL Injection via `_connector` Kwarg (CVE-2025-64459) EPSS 19%

CVE-2025-64459 web Patched

CVE-2025-64459webCRITICAL 9.1Patched2026-07-06"Grocery" PHP Application `search_products_itname.php` `sitem_name` Boolean-Based SQL Injection (CVE-2025-65354)

CVE-2025-65354 web Unpatched

CVE-2025-65354webCRITICAL 9.8Unpatched2026-07-06ZoneMinder — Second-Order SQL Injection via Event Rename (CVE-2026-27470)

CVE-2026-27470 web Patched

CVE-2026-27470webHIGH 8.8Patched2026-07-05WP Photo Album Plus Unauthenticated SQL Injection — CVE-2026-6379

CVE-2026-6379 web Patched

CVE-2026-6379webCRITICAL 8.6Patched2026-07-05Ormar ORM SQL Injection via min()/max() Aggregate Methods (CVE-2026-26198)

CVE-2026-26198 (GHSA-xxh2-68g9-8jqr) web Patched

CVE-2026-26198webCRITICAL 9.8Patched2026-07-05JoomCCK Unauthenticated SQL Injection via `tags.save` (CVE-2026-49048)

CVE-2026-49048 (Advisory ID JOOMCCK-2026-001) web Unpatched

CVE-2026-49048webCRITICAL 8.7Unpatched2026-07-05JetSearch WordPress Plugin Unauthenticated SQL Injection (CVE-2026-49079)

CVE-2026-49079 web Unverified

CVE-2026-49079webHIGH 7.5Unverified2026-07-05ITFlow Time-Based Blind SQL Injection via agent/ajax.php expires Parameter (CVE-2026-54597)

CVE-2026-54597 web Unverified

CVE-2026-54597webHIGHUnverified2026-07-05ITFlow SQL Injection via recurring_invoice_frequency (CVE-2026-54596)

CVE-2026-54596 web Unverified

CVE-2026-54596webHIGHUnverified2026-07-05CodeAstro Simple Attendance Management System 1.0 — SQL Injection Auth Bypass (CVE-2026-37749)

CVE-2026-37749 web Unverified

CVE-2026-37749webCRITICAL 9.8Unverified2026-07-05Business Directory Plugin for WordPress — Unauthenticated Time-Based Blind SQL Injection (CVE-2026-2576)

CVE-2026-2576 web Patched

CVE-2026-2576webHIGH 7.5Patched2026-07-05Apache Superset Authenticated SQL Injection via sqlExpression/where Bypass — CVE-2026-23980

CVE-2026-23980 web Patched

CVE-2026-23980webMEDIUM 6.5Patched2026-07-05