283612 matches found
Exploit for CVE-2026-102782
CVE-2026-102782 — OrdaSoft Simple Membership unauth SQLi Pyth...
CVE-2026-95605
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Passionate Programmer Peter WP Data Access allows Blind SQL Injection. This issue affects WP Data Access: from n/a through 5.5.82...
CVE-2026-62251
Homer is open source telecom observability software. Prior to version 11.0.283, the V4StatisticsQuery handler passes the user-supplied rawquery field directly to DuckDB without calling the sqlvalidator.ValidateRawSQL function used throughout the rest of the codebase. Any authenticated user can...
CVE-2026-76452
A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an authenticated, remote attacker to conduct SQL injection attacks against an affected application. This vulnerability is due to insufficient...
CVE-2026-95605
The Passionate Programmer Peter WP Data Access WordPress plugin is vulnerable to Blind SQL Injection in versions up to and including 5.5.82 . The root cause is the Improper Neutralization of Special Elements used in an SQL Command (CWE-89). This vulnerability could allow an attacker to perform un...
CVE-2026-95605 WordPress WP Data Access plugin <= 5.5.82 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Passionate Programmer Peter WP Data Access allows Blind SQL Injection. This issue affects WP Data Access: from n/a through 5.5.82...
EUVD-2026-94490
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Passionate Programmer Peter WP Data Access allows Blind SQL Injection. This issue affects WP Data Access: from n/a through 5.5.82...
CVE-2026-95605 WordPress WP Data Access plugin <= 5.5.82 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Passionate Programmer Peter WP Data Access allows Blind SQL Injection. This issue affects WP Data Access: from n/a through 5.5.82...
Exploit for Interpretation Conflict in Wordpress
wp2shell-PoC ⚠ This tool is created solely for education...
Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query
Summary The V4StatisticsQuery handler passes the user-supplied rawquery field directly to DuckDB without calling the sqlvalidator.ValidateRawSQL function used throughout the rest of the codebase. Any authenticated user can execute arbitrary SQL statements against all data accessible through the...
GHSA-F46Q-3V67-FMM4 Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query
Summary The V4StatisticsQuery handler passes the user-supplied rawquery field directly to DuckDB without calling the sqlvalidator.ValidateRawSQL function used throughout the rest of the codebase. Any authenticated user can execute arbitrary SQL statements against all data accessible through the...
EUVD-2026-94450
A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an authenticated, remote attacker to conduct SQL injection attacks against an affected application. This vulnerability is due to insufficient...
CVE-2026-76452 Cisco Smart Software Manager On-Prem SQL Injection Vulnerability
A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an authenticated, remote attacker to conduct SQL injection attacks against an affected application. This vulnerability is due to insufficient...
CVE-2026-76452 Cisco Smart Software Manager On-Prem SQL Injection Vulnerability
A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an authenticated, remote attacker to conduct SQL injection attacks against an affected application. This vulnerability is due to insufficient...
CVE-2026-76452
A vulnerability in the web-based management interface of Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem) allows an authenticated, remote attacker to conduct SQL injection attacks. This issue stems from insufficient validation of user-supplied input , where a crafted request ...
CVE-2026-62251
Homer is open source telecom observability software. Prior to version 11.0.283, the "V4StatisticsQuery" handler passes the user-supplied "rawquery" field directly to DuckDB without calling the "sqlvalidator.ValidateRawSQL" function used throughout the rest of the codebase. Any authenticated user...
CVE-2026-62251 Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query
Homer is open source telecom observability software. Prior to version 11.0.283, the V4StatisticsQuery handler passes the user-supplied rawquery field directly to DuckDB without calling the sqlvalidator.ValidateRawSQL function used throughout the rest of the codebase. Any authenticated user can...
CVE-2026-62251 Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query
Homer is open source telecom observability software. Prior to version 11.0.283, the V4StatisticsQuery handler passes the user-supplied rawquery field directly to DuckDB without calling the sqlvalidator.ValidateRawSQL function used throughout the rest of the codebase. Any authenticated user can...
EUVD-2026-94522
Homer is open source telecom observability software. Prior to version 11.0.283, the V4StatisticsQuery handler passes the user-supplied rawquery field directly to DuckDB without calling the sqlvalidator.ValidateRawSQL function used throughout the rest of the codebase. Any authenticated user can...
CVE-2026-62251 Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query
Homer is open source telecom observability software. Prior to version 11.0.283, the V4StatisticsQuery handler passes the user-supplied rawquery field directly to DuckDB without calling the sqlvalidator.ValidateRawSQL function used throughout the rest of the codebase. Any authenticated user can...