CVE-2026-81293

CriticalCVSS 9.3/10Last modified Sep 1, 2026

Description

Unauthenticated SQL Injection in WP Data Access <= 5.5.81 versions.

Metrics

CVSS 3.1 9.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Aug 31, 2026
Last modified
Sep 1, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-812949.8Unauthenticated Privilege Escalation in Authorizer <= 3.15.1 versions.CVE-2026-812957.1Unauthenticated Cross Site Scripting (XSS) in Under Construction <= 5.82 versions.CVE-2026-812967.5Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack <= 6.2.12 versions.CVE-2026-812977.5Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack <= 6.2.12 versions.CVE-2026-812987.1Unauthenticated Cross Site Scripting (XSS) in LeadConnector <= 4.0.5 versions.CVE-2026-812994.3Subscriber Insecure Direct Object References (IDOR) in WP Job Portal <= 2.5.9 versions.CVE-2026-81307.3A vulnerability was identified in SourceCodester SUP Online Shopping 1.0. This affects an unknown function of the file /admin/message.php. TCVE-2026-813007.1Unauthenticated Cross Site Scripting (XSS) in Calculation For Contact Form 7 <= 1.0 versions.CVE-2026-813018.5Ekia File Manager 1.2.7 exposes com.ekia.filecontrolmanager.OpenFileProvider as an exported Android ContentProvider without requiring callerCVE-2026-813028.5PALLET CONTROL products contain an incorrect default permission vulnerability, which may allow a local attacker to execute arbitrary code wiCVE-2026-813036.3A flaw was found in hawtio-operator. The operator holds routes/custom-host:create permission cluster-wide and writes the tenant-supplied speCVE-2026-813056.8CM2507 IP cameras automatically execute a predetermined script from removable media without verifying its authenticity or integrity. An atta
CVE-2026-81293: Critical severity, CVSS 9.3 | Vulnix