CVE-2023-3163-SQL-Injection-Prevention

CVE-2023-3163-SQL注入防护 一种简单快速的方法来检查你的Oracle SQL Developer是否容易受到SQL注入攻击（CVE-2023-3163），该漏洞最常见于SQL Developer版本 23.1.0。 CVE-2023-21969 漏洞利用 - SQL Developer 漏洞检查 描述 本仓库包含一个简单直观的CVE-2023-21969漏洞利用程序，该漏洞存在于23.1.0之前的SQL Developer版本中。此漏洞利用程序允许你检查你的SQL Developer数据库是否容易受到SQL注入攻击。这是一种快速评估数据库安全性并识别潜在风险的方法。 前提...

CVE-2022-37203

CVE-2022-37203 CVE-2022-37203 POC（概念验证） 附加信息 https://github.com/AgainstTheLight/someEXPofjfinalcms/blob/main/jfinalcms/sql3.md 漏洞类型 SQL注入 产品供应商 开发团队 受影响的产品代码库 https://github.com/jflyfox/jfinalcms - JFinal CMS 5.1.0 受影响的组件 这些接口并未使用相同的组件，也没有过滤器，但各自使用了自己的SQL拼接方法，导致SQL注入 攻击类型 远程 影响代码执行 是 影响权限提升 是...

CVE-2021-31856

Vulnerability Report CVE-2021-31856: a sql injection in Meshery item| details| note ---|---|--- project| https://github.com/layer5io/meshery| date announced| 2021-04-28| CVE-ID| CVE-2021-31856| https://vulners.com/cve/CVE-2021-31856 EDB-ID| | Vulnerable Version| v0.5.2| \ Patched Version| v0.5.3|...

CVE-2019-9053

CVE-2019-9053 CMS Made Simple 2.2.10 - SQL注入 由 Daniele Scanu 发现。可在此处 此处 找到 修复问题： "File "/home/user/CVE-2019-9053", line 25 print "+ Specify an url target" ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ SyntaxError: Missing parentheses in call to 'print'. Did you mean print...?", 包括所有其他不正确的语法...

CVE-2020-13996

Exploit Title: Joomla J2 Store 3.3.11 - 'filterorderDir' Inyección SQL Autenticado Date: 2020-04-17 Exploit Author: Mehmet Kelepçe / Gais Cyber Security Vendor Homepage: https://www.j2store.org/ Software Link: https://www.j2store.org/download.html Reference:...

CVE-2026-94130 Joomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gallery extension < 5.7.3

Joomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gallery extension 5.7.3 - An SQL injection vulnerability in video search functionality and sorting allowed attackers to inject SQL commands in read queries...

CVE-2026-94130

The YouTube Gallery extension for Joomla (by joomlaboat.com) is vulnerable to an unauthenticated SQL injection (CWE-89) in versions 1.0.0 through 5.7.2 . The flaw exists in the video search and sorting request handling, where attackers can inject SQL commands into read queries via the public yg_a...

EUVD-2026-87771

Joomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gallery extension 5.7.3 - An SQL injection vulnerability in video search functionality and sorting allowed attackers to inject SQL commands in read queries...

CVE-2026-94130 Joomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gallery extension < 5.7.3

Joomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gallery extension 5.7.3 - An SQL injection vulnerability in video search functionality and sorting allowed attackers to inject SQL commands in read queries...

cve-2023-27372

solo con fines educativos!!!!!...

CVE-2026-100683 Budibase before 3.45.0 SQL Injection via column-rename DDL

Budibase @budibase/server before 3.45.0 builds MySQL and MSSQL column-rename DDL in packages/backend-core/src/sql/sqlTable.ts by interpolating identifiers directly into a raw query string backtick-quoted for MySQL, a single-quoted sprename literal for MSSQL without applying the project's...

EUVD-2026-87656

Budibase @budibase/server before 3.45.0 builds MySQL and MSSQL column-rename DDL in packages/backend-core/src/sql/sqlTable.ts by interpolating identifiers directly into a raw query string backtick-quoted for MySQL, a single-quoted sprename literal for MSSQL without applying the project's...

CVE-2026-100683

Budibase (@budibase/server ) versions before 3.45.0 are vulnerable to SQL injection due to improper handling of column-rename DDL in packages/backend-core/src/sql/sqlTable.ts. The application interpolates identifiers directly into raw query strings for MySQL and MSSQL without using proper identif...

CVE-2026-100683 Budibase before 3.45.0 SQL Injection via column-rename DDL

Budibase @budibase/server before 3.45.0 builds MySQL and MSSQL column-rename DDL in packages/backend-core/src/sql/sqlTable.ts by interpolating identifiers directly into a raw query string backtick-quoted for MySQL, a single-quoted sprename literal for MSSQL without applying the project's...

CVE-2026-100644 SiYuan before v3.8.4 SQL Injection via dailyNoteSavePath

SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the dailyNoteSavePath parameter is concatenated into SQL without escaping. Unauthenticated attackers on published sites with auth disabled can inject SQL via UNION SELECT to extract arbitrary database ro...

EUVD-2026-87738

SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the dailyNoteSavePath parameter is concatenated into SQL without escaping. Unauthenticated attackers on published sites with auth disabled can inject SQL via UNION SELECT to extract arbitrary database ro...

CVE-2026-100644 SiYuan before v3.8.4 SQL Injection via dailyNoteSavePath

SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the dailyNoteSavePath parameter is concatenated into SQL without escaping. Unauthenticated attackers on published sites with auth disabled can inject SQL via UNION SELECT to extract arbitrary database ro...

CVE-2026-100644

Versions of SiYuan prior to v3.8.4 are vulnerable to a SQL injection vulnerability within the graph query endpoint . The root cause is the improper concatenation of the dailyNoteSavePath parameter into SQL queries without sufficient escaping. This flaw allows unauthenticated attackers targeting p...

CVE-2026-100627

The Capgo (Cap-go/capgo.app) server backend Supabase functions contain an incorrect authorization flaw in the API-key bundle promotion path. Specifically, the PUT /bundle endpoint (accessible via "all" and "write" API keys) dispatches to setChannel, which fails to include the channel_id during th...

EUVD-2026-87721

Capgo Cap-go/capgo.app server backend Supabase functions contain an incorrect authorization flaw in the API-key bundle promotion path. The PUT /bundle endpoint, available to "all" and "write" API keys, dispatches to setChannel, which authorizes with checkPermissionc, 'channel.promotebundle', appI...