CVE-2022-21661

CVE-2022-21661 PoC動画 | WordPress Core 5.8.2 - 'WPQuery' SQLインジェクション CVE-2022-21661 : EDB : https://www.exploit-db.com/exploits/50663...

CVE-2025-22710

CVE-2025-22710 1️⃣ コンポーネントの種類 WordPress プラグイン 2️⃣ コンポーネントの詳細 コンポーネント名 WooCommerce Advanced Bulk Edit Products, Orders, Coupons, Any WordPress Post Type – Smart Manager 脆弱性のあるバージョン ⚠️ 真/偽条件に基づく応答値の違いを確認するには、少なくとも1つの投稿が存在している必要があります。 1. Smart Manager プラグインがインストールされた WordPress サイトを用意し、管理者アカウントでログインして...

CVE-2026-69084-PoC

CVE-2026-69084 / CVE-2026-69085 — SiYuan 任意SQL実行 & SQLインジェクション CVE-2026-69084: /api/search/searchEmbedBlock を介した任意SQL実行 CVE-2026-69085: /api/filetree/searchDocs を介したSQLインジェクション CVSS 9.9 Critical 各 · CWE-89 · SiYuan = v3.7.2 v3.7.3で修正 公開日 2026-08-03 · 公開時点で公開PoCなし TL;DR...

ko7demo

Docker化した https://github.com/koseven/kosevenkoseven のハローワールドアプリケーションで、3.3.10未満のバージョンに影響するSQLインジェクション脆弱性 CVE-2019-8979 を試すためのものです。 このハローワールドは実際には https://koseven.dev/documentation/orm/examples/simpleドキュメント から持ってきたもので、Docker部分とPoCエクスプロイトを追加しただけです。 = CVE-2019-8979 このSQLインジェクション問題は、元々第三者によって...

CVE-2026-42324

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/elementsetranks.php stores administrator-controlled imageorder values without enforcing the existing sort-field whitelist. The stored album imageorder expression is later concatenated into ORDER BY...

CVE-2026-42324 Piwigo: Second-Order SQL Injection

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/elementsetranks.php stores administrator-controlled imageorder values without enforcing the existing sort-field whitelist. The stored album imageorder expression is later concatenated into ORDER BY...

CVE-2026-44642 Piwigo: SQL injection in upgrade authentication allows unauthenticated upgrade authorization bypass (PHP 8+)

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, checkupgradeaccessrights in admin/include/functionsupgrade.php conditionally escapes the submitted username only when the removed getmagicquotesgpc function exists, so PHP 8 and later concatenate an...

CVE-2026-44642

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, checkupgradeaccessrights in admin/include/functionsupgrade.php conditionally escapes the submitted username only when the removed getmagicquotesgpc function exists, so PHP 8 and later concatenate an...

CVE-2026-44642 Piwigo: SQL injection in upgrade authentication allows unauthenticated upgrade authorization bypass (PHP 8+)

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, checkupgradeaccessrights in admin/include/functionsupgrade.php conditionally escapes the submitted username only when the removed getmagicquotesgpc function exists, so PHP 8 and later concatenate an...

EUVD-2026-87137

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, checkupgradeaccessrights in admin/include/functionsupgrade.php conditionally escapes the submitted username only when the removed getmagicquotesgpc function exists, so PHP 8 and later concatenate an...

EUVD-2026-87136

Piwigo is a full featured open source photo gallery application for the web. In 17.0.0beta1 and earlier, when rating is enabled, an unauthenticated guest can call pwg.images.filteredSearch.create with a crafted ratings value and then open the returned search URL. include/wsfunctions/pwg.images.ph...

CVE-2026-PoCs

CVE-2026-PoCs A community-curated, verified collection of Proof-of-Concept exploits for CVEs disclosed in 2026. Why this repo Most CVE PoC collections are scattered across Twitter threads, gists, and dead blog links. This repo aims to be the single, well-organized, actively maintained index of 20...

CVE-2026-42323

Prior to version 16.4.0 , the Piwigo photo gallery application is vulnerable to SQL Injection in the admin/batch_manager.php component. The application fails to perform numeric validation on dimension width, height, ratio, and filesize values received via the Batch Manager filter URL. Because the...

CVE-2026-42323 Piwigo: SQL Injection in Batch Manager

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/batchmanager.php accepts administrator-controlled dimension width, height, and ratio values and filesize values from the Batch Manager filter URL without numeric validation. The URL filter parser...

EUVD-2026-87135

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/batchmanager.php accepts administrator-controlled dimension width, height, and ratio values and filesize values from the Batch Manager filter URL without numeric validation. The URL filter parser...

CVE-2024-27956

CVE-2024-27956 注意 WordPressを構築: docker-compose -f stack.yml up プラグインのインストール: 1. WordPressダッシュボードで、プラグイン 新規追加 を選択 2. プラグインのアップロード をクリック 3. ファイルを選択 - wp-automatic.zip - 今すぐインストール 4. インストールが完了したら、プラグインを有効化 をクリック エクスプロイト /wp-content/plugins/wp-automatic/inc/csv.php q=query&auth=%00&integ=md5query...

sql-global-injector

Ultimate-Dork WebクローラーとSQLインジェクション脆弱性のスキャン 使い方とインストール root@kitploit: - Installation apt-get install python python3 git git clone https://github.com/nu11secur1ty/sql-global-injector.git python3 -m pip install requests mechanicalsoup cd sql-global-injector - Usage python3 ultimate-dork.py -h show...

CVE-2026-33639

Versions of InvoicePlane prior to 1.7.2 are vulnerable to DDL injection due to a lack of strict integer validation in the Settings::index() function. The application interpolates the administrator-controlled tax_rate_decimal_places setting directly into an ALTER TABLE statement for ip_tax_rates. ...

EUVD-2026-87131

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane interpolates the administrator-controlled taxratedecimalplaces setting into an ALTER TABLE statement for iptaxrates in Settings::index without strict integer validation...

CVE-2019-1068

CVE-2019-1068 「svl.dll」をリバースエンジニアリングすることで実施した、Microsoft SQL Server スタックオーバーフロー脆弱性の根本原因分析とPoC。 関連記事へのリンク: 1. Ataberkのブログ 2. Fatihのブログ 3. Cemのブログ https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-1068...