60
60
42
30
60
42
Vulnerability Spotlight: Multiple vulnerabilities in OpenClinic’s GA web portal
60
60
55
30
55
60
30
35
60
55
47
60
60
30
60
47
60
60
30
60
60
60
cPanel EmailTrack SQL Injection Flaw Lets Attackers Execute Code as Root
cPanel disclosed CVE-2026-67401, an authenticated SQL injection in EmailTrack that lets attackers write files and execute code as root.
cPanel disclosed CVE-2026-67401 on September 8, 2026: a SQL injection in the EmailTrack feature that allows authenticated account holders with mail-related permissions to create arbitrary files and execute code with root privileges. Fixes shipped in v11.110.0.143, v11.134.0.55, v11.136.0.39, v11.138.0.4, and WP2 channel v11.138.1.9, with all supported versions before those releases affected. Root-level execution poses severe risk to shared hosting providers and multi-tenant servers, as it removes isolation between cPanel accounts, websites, mailboxes, and backups. Researchers Ali Mustafa (rz1027) and abed1526 responsibly reported the flaw.
52
5 Million WordPress Sites Affected by SQL Injection Vulnerability in All-in-One WP Migration and Backup WordPress Plugin
Unauthenticated second-order SQL injection found in All-in-One WP Migration and Backup plugin with 5+ million active installs.
Wordfence received a submission on August 14, 2026 for an unauthenticated second-order SQL injection vulnerability in the All-in-One WP Migration and Backup WordPress plugin. The plugin has more than 5 million active installations. The disclosure text does not include a CVE id, a patch version, or evidence of exploitation.
60
30
47
30
60
55
60
30
30
47
60