CVE-2026-16313

A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev...

UBUNTU-CVE-2026-54620

sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite aggregate functions can be freed while still referenced during aggregation, resulting in a use-after-free. This issue is fixed in version 2.9.5...

EUVD-2026-49906

A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev...

CVE-2026-16313

A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev...

sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks

Summary Using Databasecreateaggregate, createaggregatehandler, or Databasedefineaggregator to define an aggregate function, and then using an open statement calling that function after the database has been explicitly closed will result in an invalid memory read and a segmentation fault. Mitigati...

Security update for samba

This update for samba fixes the following issues CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server bsc1271672. CVE-2026-15779: pamwinbind module with mkhomedir set allows chown of critical system paths without validation bsc1271469. CVE-2026-58216: 6-byte heap...

TCExam <= 14.8.1 - Sensitive Information Exposure Detection

When installed following the default/recommended settings, TCExam = 14.8.1 allowed unauthenticated users to access the /cache/backup/ directory, which includes sensitive database backup files. !/usr/bin/env python3 -- coding: utf-8 -- """When installed following the default/recommended settings,...

WordPress Google Maps <7.11.18 - SQL Injection Detection

WordPress Google Maps plugin before 7.11.18 contains a SQL injection vulnerability. The plugin includes /class.rest-api.php in the REST API and does not sanitize field names before a SELECT statement. An attacker can possibly obtain sensitive information from a database, modify data, and execute...

SolarWinds Database Performance Analyzer 11.1.457 - Cross-Site Scripting Detection

SolarWinds Database Performance Analyzer 11.1.457 contains a reflected cross-site scripting vulnerability in its idcStateError component, where the page parameter is reflected into the HREF of the 'Try Again' Button on the page, aka a /iwc/idcStateError.iwc?page= URI. !/usr/bin/env python3 --...

Teclib GLPI <= 9.3.3 - Unauthenticated SQL Injection Detection

Teclib GLPI = 9.3.3 exposes a script /scripts/unlocktasks.php that incorrectly sanitizes user controlled data before using it in SQL queries. Thus, an attacker could abuse the affected feature to alter the semantic original SQL query and retrieve database records. !/usr/bin/env python3 -- coding:...

Nacos <1.4.1 - Authentication Bypass Detection

Nacos before version 1.4.1 is vulnerable to authentication bypass because the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint i...

IoTaWatt Configuration App Exposure Detection

An IoTaWatt configuration app was discovered. Unauthenticated access to an IoTaWatt energy monitor could give a malicious attacker the means to upload to any of several third-party energy websites/database. !/usr/bin/env python3 -- coding: utf-8 -- """An IoTaWatt configuration app was...

WhoDB < 0.45.0 - Path Traversal Detection

WhoDB contains a path traversal caused by lack of validation when opening database files, letting unauthenticated attackers access arbitrary Sqlite3 databases on the host system, exploit requires attacker to manipulate database filename input. !/usr/bin/env python3 -- coding: utf-8 -- """WhoDB...

InstaWP Connect < 0.1.0.86 - Local PHP File Inclusion Detection

The InstaWP Connect - 1-click WP Staging & Migration plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.1.0.85 via the 'instawp-database-manager' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files ...

DbGate Anonymous Access - Detection

Detected DbGate instances that allowed anonymous access due to insecure default authentication settings, where unauthenticated users could obtain a valid JWT token and access database management APIs. !/usr/bin/env python3 -- coding: utf-8 -- """Detected DbGate instances that allowed anonymous...

Drupal - Source Code Disclosure Detection

Detected exposed Drupal source code, backup files, and sensitive configurations, potentially disclosing database credentials and API keys. This exposure revealed internal system paths and critical site metadata, increasing the risk of full system compromise. !/usr/bin/env python3 -- coding: utf-8...

Uptime Kuma - Installer Detection

Detected Uptime Kuma setup page is publicly accessible with needSetup enabled, allowing unauthenticated users to complete installation and gain full admin access by access /setup-database. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Uptime Kuma setup page is publicly accessible with...

Ecology OA CheckServer - SQL Injection Detection

Ecology OA system improperly filters incoming data from users, resulting in a SQL injection vulnerability. Remote and unauthenticated attackers can use this vulnerability to conduct SQL injection attacks and steal sensitive database information. !/usr/bin/env python3 -- coding: utf-8 -- """Ecolog...

WordPress DB Backup Detection

This template checks for exposed database in wordpress. !/usr/bin/env python3 -- coding: utf-8 -- """This template checks for exposed database in wordpress.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'WordPress D...

Joomla! Database File List Detection

A Joomla! database directory /libraries/joomla/database/ was found exposed and has directory indexing enabled. !/usr/bin/env python3 -- coding: utf-8 -- """A Joomla! database directory /libraries/joomla/database/ was found exposed and has directory indexing enabled.""" from kittysploit import fro...