https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 05:37:22 +0000 https://vulnerability.circl.lu/vuln/cve-2026-13119 <p><strong>Affected:</strong> roundupwp Registrations for the Events Calendar – Event Registration Plugin</p> <p>The Registrations For The Events Calendar plugin for WordPress is vulnerable to SQL Injection via JSON keys in the &#39;standard&#39; parameter handled by the rtec_records_edit AJAX action in versions up to and including 3.2. The handler decodes attacker-controlled JSON from $_POST[&#39;standard&#39;] and uses the JSON array keys directly as column identifiers in the SET clause of an UPDATE statement built inside RTEC_Db_Admin::update_entry(). Only esc_sql() (mysqli_real_escape_string) is applied to the identifier; that function escapes quotes, backslashes, and a few control characters but does not escape spaces, equals signs, parentheses, or hyphens, so an attacker can break out of the identifier context and inject subqueries (terminated with a SQL comment). This makes it possible for authenticated attackers, with Contributor-level access and above who can edit the targeted event, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.</p> <p><strong>Affected:</strong> roundupwp Registrations for the Events Calendar – Event Registration Plugin</p> <p>The Registrations For The Events Calendar plugin for WordPress is vulnerable to SQL Injection via JSON keys in the &#39;standard&#39; parameter handled by the rtec_records_edit AJAX action in versions up to and including 3.2. The handler decodes attacker-controlled JSON from $_POST[&#39;standard&#39;] and uses the JSON array keys directly as column identifiers in the SET clause of an UPDATE statement built inside RTEC_Db_Admin::update_entry(). Only esc_sql() (mysqli_real_escape_string) is applied to the identifier; that function escapes quotes, backslashes, and a few control characters but does not escape spaces, equals signs, parentheses, or hyphens, so an attacker can break out of the identifier context and inject subqueries (terminated with a SQL comment). This makes it possible for authenticated attackers, with Contributor-level access and above who can edit the targeted event, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.</p> https://vulnerability.circl.lu/vuln/cve-2026-13119