CVE-2026-108124

The wp-post-author plugin, specifically versions before 4.1.0 , is vulnerable to an authenticated SQL injection (CWE-89). The root cause is the improper neutralization of special elements used in an SQL command. This vulnerability allows an attacker with high privileges to impact confidentiality ...

EUVD-2026-95819

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in wp-post-author. This issue affects wp-post-author before 4.1.0...

CVE-2026-108124 WordPress Post Author Authenticated SQLi

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in wp-post-author. This issue affects wp-post-author before 4.1.0...

CVE-2023-1454

CVE-2023-1454 jmreport/qurestSql 비인가 SQL 인젝션 배치 스캔 poc Jeecg-Boot는 Spring Boot 및 Jeecg-Boot-Plus 기반의 빠른 개발 플랫폼으로, 최신 jeecg-boot 3.5.0에서 여러 SQL 인젝션 취약점이 발견되었습니다. 도구 활용 python3 CVE-2023-1454-scan.py -u http://127.0.0.1:1111 단일 URL 테스트 python3 CVE-2023-1454-scan.py -f url.txt 일괄 검사 스캔이 끝나면 현재 디렉터리에...

CVE-2026-108107 PHPNuxBill through 2025.3.20 Unauthenticated SQL Injection via radius.php

PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw queries. Attackers can send crafted username, macAddr or nasid parameters to the accounting or authenticate actions to...

EUVD-2026-95808

PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw queries. Attackers can send crafted username, macAddr or nasid parameters to the accounting or authenticate actions to...

CVE-2026-108107

PHPNuxBill versions through 2025.3.20 are vulnerable to an unauthenticated SQL injection in the radius.php FreeRADIUS REST endpoint. The root cause is the improper interpolation of request parameters into whereRaw() queries. Attackers can submit crafted username , macAddr , or nasid parameters du...

CVE-2026-108107 PHPNuxBill through 2025.3.20 Unauthenticated SQL Injection via radius.php

PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw queries. Attackers can send crafted username, macAddr or nasid parameters to the accounting or authenticate actions to...

CVE-2026-107803

ProcessMaker is an open source workflow management software suite. Prior to 2026.14.3, the GET /api/1.0/tasks endpoint in ProcessMaker is vulnerable to SQL injection through the orderby parameter because ProcessMaker\Traits\TaskControllerIndexMethods::applyColumnOrdering concatenates a...

CVE-2026-108100 HortusFox before 6.2 SQL Injection via /api/locations/list include_info Parameter

HortusFox hortusfox-web before 6.2 contains an SQL injection vulnerability that allows API token holders to inject SQL by supplying crafted includeinfo values to the /api/locations/list endpoint. Attackers can place subqueries in includeinfo, which PlantsModel::getSpecificInfo concatenates into t...

EUVD-2026-95791

HortusFox hortusfox-web before 6.2 contains an SQL injection vulnerability that allows API token holders to inject SQL by supplying crafted includeinfo values to the /api/locations/list endpoint. Attackers can place subqueries in includeinfo, which PlantsModel::getSpecificInfo concatenates into t...

CVE-2026-108100

HortusFox (hortusfox-web) before version 6.2 is vulnerable to an SQL injection flaw within the /api/locations/list endpoint. The root cause is located in PlantsModel::getSpecificInfo() , which insecurely concatenates user-supplied include_info values into the SQL column list. This allows authenti...

CVE-2026-108100 HortusFox before 6.2 SQL Injection via /api/locations/list include_info Parameter

HortusFox hortusfox-web before 6.2 contains an SQL injection vulnerability that allows API token holders to inject SQL by supplying crafted includeinfo values to the /api/locations/list endpoint. Attackers can place subqueries in includeinfo, which PlantsModel::getSpecificInfo concatenates into t...

CVE-2024-10140

CVE-2024-10140 이 스크립트는 엔드포인트 /php/managesupplier.php?action=delete&id=32에서 발견된 SQL 인젝션 취약점을 악용합니다. 이 취약점은 공격자가 id 매개변수를 통해 임의의 SQL 명령을 주입할 수 있게 하여, 잠재적으로 데이터베이스를 손상시키고 민감한 정보를 노출시킬 수 있습니다...

CVE-2026-107803 ProcessMaker has SQL injection in the tasks endpoint through the order_by parameter

ProcessMaker is an open source workflow management software suite. Prior to 2026.14.3, the GET /api/1.0/tasks endpoint in ProcessMaker is vulnerable to SQL injection through the orderby parameter because ProcessMaker\Traits\TaskControllerIndexMethods::applyColumnOrdering concatenates a...

EUVD-2026-95777

ProcessMaker is an open source workflow management software suite. Prior to 2026.14.3, the GET /api/1.0/tasks endpoint in ProcessMaker is vulnerable to SQL injection through the orderby parameter because ProcessMaker\Traits\TaskControllerIndexMethods::applyColumnOrdering concatenates a...

CVE-2026-107803 ProcessMaker has SQL injection in the tasks endpoint through the order_by parameter

ProcessMaker is an open source workflow management software suite. Prior to 2026.14.3, the GET /api/1.0/tasks endpoint in ProcessMaker is vulnerable to SQL injection through the orderby parameter because ProcessMaker\Traits\TaskControllerIndexMethods::applyColumnOrdering concatenates a...

CVE-2026-107803

The open-source workflow management software ProcessMaker is vulnerable to SQL injection in the GET /api/1.0/tasks endpoint prior to version 2026.14.3 . The root cause is located in ProcessMaker raits askcontrollerindexmethods::applycolumnordering(), where the application concatenates a user-cont...

CVE-2026-35194

CVE-2026-35194 — Apache Flink SQL Code Injection Remote code execution on Apache Flink TaskManagers via SQL code generation injection. | ---|--- CVE| CVE-2026-35194 CVSS| 8.1 High CWE| CWE-94 — Code Injection Affected| Flink 1.15.0 – 1.20.3 / 2.0.0 – 2.2.0 Fixed| 1.20.4 / 2.0.2 / 2.1.2 / 2.2.1...

CVE-2024-27956

CVE-2024-27956 참고 WordPress 빌드: docker-compose -f stack.yml up 플러그인 설치: 1. WordPress 대시보드에서 Plugins Add New를 선택하세요. 2. Upload Plugin을 클릭하세요. 3. 파일 선택 - wp-automatic.zip - Install Now 4. 설치가 완료되면 Activate Plugin을 클릭하세요. 익스플로잇 /wp-content/plugins/wp-automatic/inc/csv.php...