CVE-2026-54790

The open-source invoice management application InvoicePlane (prior to version 1.7.2 ) is vulnerable to a second-order SQL injection within the Custom Fields module . The root cause is the lack of validation for the administrator-controlled custom_field_table value. The Mdl_custom_fields::used() f...

CVE-2026-54790 InvoicePlane: Second-order SQL injection through the unvalidated custom_field_table field in the Custom Fields module

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane stores an administrator-controlled customfieldtable value without validating it against the allowed custom-field table names. Mdlcustomfields::used later concatenates...

CVE-2026-54790 InvoicePlane: Second-order SQL injection through the unvalidated custom_field_table field in the Custom Fields module

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane stores an administrator-controlled customfieldtable value without validating it against the allowed custom-field table names. Mdlcustomfields::used later concatenates...

CVE-2026-54790 InvoicePlane: Second-order SQL injection through the unvalidated custom_field_table field in the Custom Fields module

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane stores an administrator-controlled customfieldtable value without validating it against the allowed custom-field table names. Mdlcustomfields::used later concatenates...

CVE-2026-56292-AcyMailing-SQLi

CVE-2026-56292 — Inyección SQL no autenticada en AcyMailing para Joomla Autor: nullwhisper Solo para investigación de seguridad autorizada / validación de vulnerabilidades. AcyMailing para Joomla expone la tarea pública de front-end frontentityselect::loadEntityFront. En versiones antiguas, el...

CVE-2026-84893

IBM Guardium Data Protection 12.2 is vulnerable to SQL injection in the PESI service. An authenticated attacker could exploit this vulnerability to access sensitive information in the internal database...

CVE-2026-84893 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 is vulnerable to SQL injection in the PESI service. An authenticated attacker could exploit this vulnerability to access sensitive information in the internal database...

EUVD-2026-87103

IBM Guardium Data Protection 12.2 is vulnerable to SQL injection in the PESI service. An authenticated attacker could exploit this vulnerability to access sensitive information in the internal database...

CVE-2026-84893

IBM Guardium Data Protection 12.2 is vulnerable to an SQL injection flaw located in the PESI service . This vulnerability allows an authenticated attacker to exploit the service to gain unauthorized access to sensitive information stored within the internal database. No specific exploit details o...

CVE-2026-84893 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 is vulnerable to SQL injection in the PESI service. An authenticated attacker could exploit this vulnerability to access sensitive information in the internal database...

CVE-2026-35194

CVE-2026-35194 — Inyección de código SQL en Apache Flink Ejecución remota de código en los TaskManagers de Apache Flink mediante inyección en la generación de código SQL. | ---|--- CVE| CVE-2026-35194 CVSS| 8.1 Alta CWE| CWE-94 — Inyección de código Afectados| Flink 1.15.0 – 1.20.3 / 2.0.0 – 2.2....

wp2shell-PoC

wp2shell-PoC ⚠ Esta herramienta ha sido creada únicamente con fines educativos o de bug bounty. Queda estrictamente prohibido su uso no autorizado fuera de entornos controlados. Descripción general Prueba de concepto para la cadena de vulnerabilidades wp2shell que afecta a WordPress Core,...

CVE-2026-48842

CVE-2026-48842 — Roundcube virtuserquery pre-auth SQLi Python 3 checker for CVE-2026-48842 in Roundcube Webmail optional virtuserquery plugin. PoCbit This PoC is listed on PoCbit — CVE-2026-48842 on pocbit.org. Running the PoC prints a PoCbit header; JSONL lines include pocbit / pocbitpage. |...

wp2shell-compromise-scanner-plugin

Escáner de compromiso para wp2shell solo lectura Un plugin de WordPress independiente y de solo lectura que escanea tu base de datos y el directorio de plugins en busca de señales de que la cadena principal de wp2shell CVE-2026-63030 + CVE-2026-60137 fue explotada — incluso si ocurrió hace semana...

obridge

OBridge OBridge provides a simple Java source code generator for calling Oracle PL/SQL package procedures. Supported input, output parameters and return values are: BINARYINTEGER BOOLEAN CHAR CLOB BLOB DATE NCHAR NUMBER NVARCHAR2 OBJECT - Oracle Object Type PLSINTEGER TABLE - Table of Oracle Obje...

CVE-2025-57819-RCE

FreePBX 16 — Unauthenticated SQLi to RCE Resumen: Este documento muestra cómo combinar dos vulnerabilidades de FreePBX 16 CVE-2025-57819 y CVE-2025-61678 para lograr una cadena de ataque completa que permite escalar desde el acceso no autenticado hasta la ejecución remota de código Remote Code...

WordPress GamiPress plugin <= 8.0.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Bruno Alvarenga in WordPress Plugin GamiPress versions = 8.0.2...

WordPress WP Data Access plugin <= 5.5.84 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Raphael P. Cigana in WordPress Plugin WP Data Access versions = 5.5.84...

POC-CVE-2026-65971

CVE-2026-65971 — Inyección SQL en Livewire PowerGrid mediante sortDirection Prueba de concepto e informe técnico completo para CVE-2026-65971 / GHSA-7fgc-3h6c-698r , una inyección SQL en power-components/livewire-powergrid accesible a través de la propiedad pública sortDirection de Livewire. |...

CVE-2026-52614

CVE-2026-52614 - RuoYi v4.8.3 Bypass de filterKeyword para Inyección SQL Chino | Inglés Se requiere autorización / Solo pruebas autorizadas Este repositorio está destinado únicamente a la investigación de seguridad y las pruebas autorizadas. No lo utilice contra sistemas sin permiso explícito. Es...