260349 matches found
CVE-2026-76452
A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an authenticated, remote attacker to conduct SQL injection attacks against an affected application. This vulnerability is due to insufficient...
EUVD-2026-94490
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Passionate Programmer Peter WP Data Access allows Blind SQL Injection. This issue affects WP Data Access: from n/a through 5.5.82...
CVE-2026-95605 WordPress WP Data Access plugin <= 5.5.82 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Passionate Programmer Peter WP Data Access allows Blind SQL Injection. This issue affects WP Data Access: from n/a through 5.5.82...
CVE-2026-95605
The Passionate Programmer Peter WP Data Access WordPress plugin is vulnerable to Blind SQL Injection in versions up to and including 5.5.82 . The root cause is the Improper Neutralization of Special Elements used in an SQL Command (CWE-89). This vulnerability could allow an attacker to perform un...
CVE-2026-95605 WordPress WP Data Access plugin <= 5.5.82 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Passionate Programmer Peter WP Data Access allows Blind SQL Injection. This issue affects WP Data Access: from n/a through 5.5.82...
Exploit for Interpretation Conflict in Wordpress
wp2shell-PoC ⚠ This tool is created solely for education...
Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query
Summary The V4StatisticsQuery handler passes the user-supplied rawquery field directly to DuckDB without calling the sqlvalidator.ValidateRawSQL function used throughout the rest of the codebase. Any authenticated user can execute arbitrary SQL statements against all data accessible through the...
GHSA-F46Q-3V67-FMM4 Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query
Summary The V4StatisticsQuery handler passes the user-supplied rawquery field directly to DuckDB without calling the sqlvalidator.ValidateRawSQL function used throughout the rest of the codebase. Any authenticated user can execute arbitrary SQL statements against all data accessible through the...
CVE-2026-76452
A vulnerability in the web-based management interface of Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem) allows an authenticated, remote attacker to conduct SQL injection attacks. This issue stems from insufficient validation of user-supplied input , where a crafted request ...
EUVD-2026-94450
A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an authenticated, remote attacker to conduct SQL injection attacks against an affected application. This vulnerability is due to insufficient...
CVE-2026-76452 Cisco Smart Software Manager On-Prem SQL Injection Vulnerability
A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an authenticated, remote attacker to conduct SQL injection attacks against an affected application. This vulnerability is due to insufficient...
CVE-2026-76452 Cisco Smart Software Manager On-Prem SQL Injection Vulnerability
A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an authenticated, remote attacker to conduct SQL injection attacks against an affected application. This vulnerability is due to insufficient...
EUVD-2026-94522
Homer is open source telecom observability software. Prior to version 11.0.283, the V4StatisticsQuery handler passes the user-supplied rawquery field directly to DuckDB without calling the sqlvalidator.ValidateRawSQL function used throughout the rest of the codebase. Any authenticated user can...
CVE-2026-62251 Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query
Homer is open source telecom observability software. Prior to version 11.0.283, the V4StatisticsQuery handler passes the user-supplied rawquery field directly to DuckDB without calling the sqlvalidator.ValidateRawSQL function used throughout the rest of the codebase. Any authenticated user can...
CVE-2026-62251
Homer, an open-source telecom observability software, is vulnerable to SQL Injection (CWE-89) in versions prior to 11.0.283 . The V4StatisticsQuery handler in coordinator/handlers/statistics_v4.go fails to call the sqlvalidator.ValidateRawSQL function, allowing it to pass the user-supplied rawque...
CVE-2026-62251 Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query
Homer is open source telecom observability software. Prior to version 11.0.283, the V4StatisticsQuery handler passes the user-supplied rawquery field directly to DuckDB without calling the sqlvalidator.ValidateRawSQL function used throughout the rest of the codebase. Any authenticated user can...
CVE-2026-62251 Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query
Homer is open source telecom observability software. Prior to version 11.0.283, the V4StatisticsQuery handler passes the user-supplied rawquery field directly to DuckDB without calling the sqlvalidator.ValidateRawSQL function used throughout the rest of the codebase. Any authenticated user can...
sparx_hack
Multiple vulnerabilities in Sparx Pro Cloud Server and Enterprise Architect Exploit code for executing arbitrary SQL command in Sparx PCS server without authentication. NOTE: the key is NOT correct to prevent s|rIpt kIddi3 from easy hacking ;- Full writeup:...
cve-2025-25257
CVE-2025-25257 - Experimentation Environment Experiment Architecture the environment simulates vulnerable FortiWeb components Vulnerable endpoint: /api/system/fabric/config Injection vector: HTTP Header Authorization: Bearer Mechanism: Direct SQL concatenation Python f-string Authentication: None...