Export limit exceeded: 26203 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-16959

Media Library Assistant < 3.40 - Author+ SQL Injection via mla_search_connector

The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlers, allowing users with the Author role to perform SQL injection.

CVSS 3.1 · 6.8 Medium EPSS 1.3% KEV · Not listed
Vendors
Media Library Assistant Project Wordpress
Products
Media Library Assistant Wordpress
CVE-2023-0279

Media Library Assistant < 3.06 - Admin+ SQLi

The Media Library Assistant WordPress plugin before 3.06 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Media Library Assistant Project
Products
Media Library Assistant