CVE Watch13 de nov. de 2026

CVE-2026-116509

The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via the 'qpages' pa

CVSS

6.5

Média

EPSS

—

KEV

—

Exploit Today

0-100

Publicado: 13 de nov. de 2026 · Última mod.: 13 de nov. de 2026 · CWE-89

EPSS · 30d

Ainda não há histórico EPSS suficiente.

Descrição técnica

The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via the 'qpages' parameter in all versions up to, and including, 11.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injected payload survives storage and a published-status check in display_shortcode() because a non-numeric ID causes the isPublished lookup to return an empty string, after which the payload is imploded directly into a WHERE question_id IN() clause via plain string interpolation with no wpdb->prepare() or esc_sql() call.

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-1291807.3 ALT

—

———A flaw has been found in projectworlds Visitor Management System 1.0. This vulnerability affects the function mysqli_query of the file actionpage.php. This manipulation of the argument purpose causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.3h CVE-2026-1291719.8 CRÍ

—

———NginxPulse 1.5.0 before 1.6.26 contains an unauthenticated sql injection vulnerability that allows remote attackers to append SQL via the id and locationType parameters of /api/stats/:type. Attackers can close the quoted table-name identifier and use error-based output to read database contents, and read or write server files via PostgreSQL superuser functions.8h CVE-2026-1291666.5 MÉD

—

———Keep 0.34.10 through 0.55.0 contains a blind SQL injection vulnerability in its CEL-to-SQL converter, which inserts bracket-indexed JSON keys from CEL filters unescaped into JSON path expressions for SQLite, PostgreSQL, and MySQL. Authenticated users with read:alert permission can submit crafted CEL expressions to /alerts/query or the cel parameter of /incidents, using result counts as a boolean oracle to extract other tenants' alerts and password hashes.8h CVE-2026-1291606.5 MÉD

—

———free-fs 2.0.1 through 2.3.1 contains an SQL injection vulnerability in FileShareServiceImpl.getPages, which passes the orderBy parameter of the /apis/share/pages endpoint verbatim into the ORDER BY clause via MyBatis-Flex without a column whitelist. Authenticated users can supply CASE WHEN subquery expressions that use share ordering as a boolean oracle to read arbitrary database contents, such as share codes.8h CVE-2026-1240416.5 MÉD

—

———Catalis/Patriot Properties WebPro 5.0 allows a remote unauthenticated attacker to execute arbitrary SQL queries against the underlying MSSQL database, enabling exfiltration of sensitive property and taxpayer information.4h CVE-2026-631676.5 MÉD

—

———Omnispace Agora Project through 26.10.0 contains a SQL injection vulnerability that allows authenticated general administrators to inject arbitrary SQL by setting the personsSort session value, which is concatenated unsanitized into ORDER BY clauses in MdlUser.php and MdlSpace.php. Attackers can submit an error-based extractvalue payload through personsSort to leak database information, such as the MariaDB version, via the user and space listing pages.8h