CVE-2023-1454-EXP

JeecgBoot SQL CVE-2023-1454 Exploit 1. Vulnerability Details jeecg-boot version 3.5.0 has an SQL injection vulnerability, which stems from a security issue in the file jmreport/qurestSql, leading to SQL injection via the parameter apiSelectId. 2. Usage python3 CVE-2023-1454.py optional arguments:...

ApacheSkywalking

ApacheSkywalking ApacheSKywalking SQLi to Read sensitive file...

CVE-2026-26980

CVE-2026-26980 ★ CVE-2026-26980 TryGhost Ghost CMS Content API SQL Injection PoC ★ https://github.com/user-attachments/assets/e7fab29e-8382-4ecc-986c-68852c28a32c Overview CVE-2026-26980 is an unauthenticated SQL Injection vulnerability in TryGhost Ghost CMS Content API. The vulnerable path is...

CVE-2026-32127_SqlInjectionVulnerabilityOpenEMR8.0.0

CVE-2026-32127 - SQL Injection Vulnerability in OpenEMR 8.0.0 Weakness CWE-89 Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not...

CVE-2025-6783

Inject an always-true condition into the WHERE clause so that every row matches: curl -i -X POST \ -H "Content-Type: application/json" \ -H "forms-id: poc-001' OR '1'='1' -- " \ -H "domain-id: example.com" \ -d ' "emabedtype":"iframe", "shortcodetitle":"INJECTED", "shortcodetag":"xss", "active":0...

CVE-2026-18782-TREX-MES-Uygulamalarinda-SQL-Zafiyeti

TREX-MES-Uygulamalarında-SQLi-Zafiyeti CVE-2026-18782 Genel Bakış TREX MES, üretim sahasından veri toplamak ve yönetmek için kullanılan ticari bir Üretim Yürütme Sistemi MES / Endüstri 4.0 platformudur. Uygulamanın web API'si, istemciden gelen sql parametresi doğrudan arka uçtaki Microsoft SQL...

EUVD-2026-95328

IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command...

EUVD-2026-95338

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute unauthorized SQL statements due to SQL injection...

EUVD-2026-95334

IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database...

EUVD-2025-211053

Jivejdon through 5.0 contains a sql injection vulnerability in AccountDaoSql.getAccountByNameLike that allows authenticated administrators to inject SQL via the username parameter. Attackers with the Admin role can submit crafted input to /admin/user/userListAction to read database contents,...

PT-2026-108909

ProcessMaker is an open source workflow management software suite. Prior to 2026.14.3, the GET /api/1.0/tasks endpoint in ProcessMaker is vulnerable to SQL injection through the order by parameter because ProcessMakerTraitsTaskControllerIndexMethods::applyColumnOrdering concatenates a...

PT-2026-108844

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in VibeThemes WPLMS wplms allows Blind SQL Injection.This issue affects WPLMS : from n/a through 4.973...

PT-2026-108843

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Taskbuilder Taskbuilder taskbuilder allows Blind SQL Injection.This issue affects Taskbuilder: from n/a through 6.0.5...

PT-2026-108849

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in jegtheme JNews - Pay Writer jnews-pay-writer allows Blind SQL Injection.This issue affects JNews - Pay Writer: from n/a through 12.0.1...

PT-2026-108847

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in UpSolution UpSolution Core us-core allows Blind SQL Injection.This issue affects UpSolution Core: from n/a through 9.3...

PT-2026-108848

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in VibeThemes WPLMS wplms plugin allows Blind SQL Injection.This issue affects WPLMS: from n/a before 1.9.9.8.2...

CVE-2026-108100: Improper Neutralization of Special Elements used in an SQL Command

HortusFox hortusfox-web before 6.2 contains an SQL injection vulnerability that allows API token holders to inject SQL by supplying crafted includeinfo values to the /api/locations/list endpoint. Attackers can place subqueries in includeinfo, which PlantsModel::getSpecificInfo concatenates into t...

PT-2026-108819

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through 3.2.9...

PT-2026-109330

Name of the Vulnerable Software and Affected Versions JetBrains Exposed versions prior to 1.5.1 Description SQL injection is possible because several SQL functions accept raw string arguments that are not escaped or parameterized. This allows crafted input to break out of the query context and...

PT-2026-108865

Name of the Vulnerable Software and Affected Versions EduAdmin Booking versions prior to 6.0.0 Description An issue exists where improper neutralization of special elements used in an SQL command allows for Blind SQL Injection. Blind SQL Injection is a technique that allows an attacker to infer...