📄 LiteLLM 1.83.6 Blind SQL Injection

A proof of concept exploit for a pre-authentication blind SQL injection vulnerability in LiteLLM version 1.83.6. The vulnerability affects LiteLLM proxy versions 1.81.16 through 1.83.6 and occurs because the virtual-key lookup interpolates an unauthenticated bearer token directly into a PostgreSQ...

Linux Distros Unpatched Vulnerability : CVE-2026-71235

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Lua scri...

Drupal Core 11.3.9 Anonymous Blind SQL Injection

A proof of concept exploit for an anonymous blind SQL injection vulnerability in Drupal Core version 11.3.9. The vulnerability affects Drupal Core versions 8.9.0 through 11.3.9 when using PostgreSQL as the database backend and is caused by improper handling of attacker-controlled array keys while...

PT-2026-68060

Name of the Vulnerable Software and Affected Versions WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars versions prior to 3.9.2 Description This issue is a generic SQL Injection, which occurs when an application fails to properly sanitize user input, allowing an attack...

PT-2026-68217

Name of the Vulnerable Software and Affected Versions Progress MarkLogic Server versions prior to 11.3.6 Progress MarkLogic Server versions prior to 12.0.3 Description Improper privilege management in the REST API document patch operation allows an authenticated user with a low-privileged REST ro...

PT-2026-68058

Name of the Vulnerable Software and Affected Versions JoomSport – for Sports: Team & League, Football, Hockey & more versions prior to 5.7.10 Description This issue is a time-based SQL Injection, a technique used to infer data from a database by observing the time it takes for the server to respo...

PT-2026-68220

Name of the Vulnerable Software and Affected Versions Progress MarkLogic Server versions prior to 11.3.6 Progress MarkLogic Server versions prior to 12.0.3 Description An improper privilege management issue in the Hadoop integration allows an authenticated user with a low-privileged Hadoop role t...

📄 FineAdmin.Mvc SQL Injection

A proof of concept exploit for a SQL injection vulnerability in FineAdmin.Mvc. Insufficient validation of the field and order parameters allows arbitrary SQL expressions to be injected into the ORDER BY clause, enabling error-based and time-based SQL injection against affected endpoints...

PT-2026-68039

Name of the Vulnerable Software and Affected Versions Xpro Addons versions prior to 1.5.2 Description The Xpro Addons plugin for WordPress contains a flaw allowing unauthorized data creation due to a missing capability check in the get menu content editor function. Authenticated users with...

PT-2026-68573

Name of the Vulnerable Software and Affected Versions Iptanus File Upload versions prior to 5.1.8 Description An unauthenticated SQL Injection exists due to insufficient escaping of user-supplied parameters and a lack of proper preparation of SQL queries. This allows attackers to append additiona...

PT-2026-68161

Name of the Vulnerable Software and Affected Versions Koha affected versions not specified Description The guided report builder in reports/guided reports.pl is susceptible to time-based blind SQL injection. The application reads the order by CGI parameter and a dynamically-named order ovalue...

PT-2026-68018

Name of the Vulnerable Software and Affected Versions TableOn – WordPress Posts Table Filterable versions prior to 1.0.5.2 Description Unauthenticated attackers can perform blind SQL Injection through the filter datacomment count parameter of the public tableon get table data AJAX action. The iss...

PT-2026-68164

Name of the Vulnerable Software and Affected Versions Subrion CMS affected versions not specified Description The admin grid sorting helper gridGetSorting in includes/classes/ia.base.controller.admin.php fails to properly validate the sort GET parameter. While the function attempts to whitelist t...

PT-2026-67949

Name of the Vulnerable Software and Affected Versions PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin versions prior to 3.6.21 Description An issue exists where authenticated attackers with Administrator-level access and above can perform SQL...

CVE-2026-71252: Missing Authorization

toner-management's admin state-changing handlers add.php, edit.php, delete.php under admin/toners, admin/toner-brands, admin/printers, and related admin subdirectories executed INSERT/UPDATE/DELETE database operations with no authentication or authorization check, while access control was enforce...

CVE-2026-71241: Missing Authentication for Critical Function

Book-Management-System's Flask API endpoints /student, /record, /books, /findstubook, and /findnotreturnbook are missing the @loginrequired decorator that protects sibling routes /searchstudent, /storage in the same file. Because cardid values are sequential integers, the entire student database...

CVE-2026-7105: Missing Authorization

The Xpro Addons plugin for WordPress is vulnerable to unauthorized creation of data due to a missing capability check on the getmenucontenteditor function in all versions up to, and including, 1.5.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

CVE-2026-9193: Improper Privilege Management

An improper privilege management vulnerability in the Hadoop integration of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged Hadoop role to escalate privileges and execute privileged operations against the Security database...

CVE-2026-8709: Improper Privilege Management

An improper privilege management vulnerability in the REST API document patch operation of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges and execute privileged operations against the Security database...

CVE-2026-44605: Integer Overflow or Wraparound

A flaw was found in the RPM Package Manager RPM. A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an error in how RPM handles certain calculations during file parsing, leading to an incorrect memor...