Discover how the TikTok WordPress Toolkit could enable hackers to steal AWS, SMTP, and API credentials, posing serious security risks to users.

On June 17, 2026, the U.S. Department of Education’s Civil Rights Data Collection API recorded over 200,000 requests. Among them was a failed SQL injection attempt, where the string ‘State_Id=1 OR 1=1 ...

Discover how a persistent WordPress backdoor rebuilds itself after cleanup by exploiting files, databases, and shared memory ...

Roundcube SQL injection CVE-2026-48842 is now being exploited in the wild, putting unpatched webmail servers at risk of ...

A public proof-of-concept exploit has been released for CVE-2026-23980, a SQL injection vulnerability affecting Apache Superset versions before 6.0.0. The flaw could allow authenticated users with ...

A single unauthenticated HTTP request to Metabase's password-reset endpoint was all it took for an attacker to gain full administrator access to an analytics platform trusted by tens of thousands of ...

Attackers chained SQL injection with Oracle’s embedded Java capabilities to hide a custom post-exploitation toolkit inside the database and gain SYSTEM-level access to the underlying Windows server.

Drupal is warning that hackers are attempting to exploit a "highly critical" SQL injection vulnerability announced earlier this week. The content management system (CMS) project published a PSA on May ...

A critical SQL injection vulnerability in ProFTPD’s mod_sql extension, tracked as CVE-2026-42167, that enables remote code execution, authentication bypass, and privilege escalation in some ...

A critical SQL injection flaw in FortiClient EMS allows remote code execution and data exfiltration, leaving thousands of internet facing systems at risk. Yet another critical flaw in a Fortinet ...