Tag

#Blind SQL Injection

newsMEDIUM 6.5

CVE-2026-16588: WP Directory Kit Plugin for WordPress Vulnerable to Blind SQL Injection

The WP Directory Kit plugin for WordPress is vulnerable to blind SQL injection via the 'order_by' parameter in versions up to 1.5.4. Authenticated attackers with custom-level access and above can exploit this flaw to extract sensitive information from the database. A CVSS score of 6.5 indicates a medium severity vulnerability.

1 source
blogHIGH 8.3

Understanding and Defending Against Blind SQL Injection in Revive Adserver

This educational analysis covers CVE-2026-34914, a blind SQL injection vulnerability in Revive Adserver 6.0.6 and earlier. The vulnerability allows a low-privileged user to exploit the clientid parameter in the zone-include.php script. We will delve into the root cause, attack surface, exploitation mechanics, real-world impact, detection, and defense strategies.

1 source