EUVD-2026-93253

Unauthenticated Cross Site Scripting XSS in Database for CF7 = 1.2.6 versions...

CVE-2026-39731 WordPress Database for CF7 plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Database for CF7 = 1.2.6 versions...

CVE-2026-4889 SQL Injection (SQLi) in eLoanApp Platform by RDL Technologies

SQL injection SQLi vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/ajax/users.php?op=verify'. The parameter is vulnerable to boolean-based and time-based SQL injection. Successfully exploiting this vulnerability would allow an...

CVE-2026-4889 SQL Injection (SQLi) in eLoanApp Platform by RDL Technologies

SQL injection SQLi vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/ajax/users.php?op=verify'. The parameter is vulnerable to boolean-based and time-based SQL injection. Successfully exploiting this vulnerability would allow an...

CVE-2023-34468-POC

CVE-2023-34468 — Apache NiFi 1.21.0 RCE PoC Esecuzione remota di codice tramite istruzione RUNSCRIPT del database H2 in Apache NiFi = 1.21.0 Vulnerabilità Apache NiFi include di default un JAR del database H2. Il controller service DBCPConnectionPool può essere configurato per utilizzare questo...

Advanced-SQL-Injection-Cheatsheet

Cheat sheet per SQL Injection basata su errori MySQL Questa è probabilmente la vulnerabilità più semplice nell'ambito dell'attacco SQL Injection. Un attaccante può enumerare e dumpare il database MySQL sfruttando i messaggi di errore SQL a suo vantaggio. Rilevare la...

EUVD-2026-92957

Subscriber Bypass Vulnerability in WP Migration Plugin DB & Files – WP Synchro = 1.16.1 versions...

atutor-blind-sqli

ATutor v2.2.1 SQL Injection Cieca Sfruttamento di CVE-2016-2555 per enumerare e dumpare il database sottostante. Disclaimer Tutte le informazioni fornite in questo post sono solo a scopo educativo. Non si deve fare un uso improprio delle informazioni per ottenere accesso non autorizzato e/o...

Kaseya VSA 2017 ConnectWise ManagedITSync - Remote Code Execution

ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. If the ManagedIT.asmx page is available via the Kaseya VSA web interface, anyone with access to the page is able to run...

litellm-sqli-scanner

LiteLLM SQL Injection Scanner CVE-2026-42208 — SQL injection nel LiteLLM Proxy Rileva e convalida CVE-2026-42208: vulnerabilità di SQL injection nel livello del database di LiteLLM Proxy. Solo per test di sicurezza autorizzati. Funzionalità Rilevamento di SQL injection CVE-2026-42208 Fingerprinti...

onedrive_user_enum

onedriveuserenum v2.10 Gültige OneDrive-Benutzer enumerieren Eine vollständige Erläuterung der Enumerationstechnik und der OneDrive-Enumeration finden Sie im Blog hier: https://www.trustedsec.com/blog/onedrive-to-enum-them-all/ Wenn Sie nach der alten Version ohne Datenbank der OneDrive-Enumerati...

nuclei-cve-analyzer

Nuclei CVE Analyzer A fast CLI tool for analyzing CVE coverage in Nuclei templates. Nuclei CVE Analyzer takes a list of CVE IDs, scans a local Nuclei template repository, and determines which CVEs already have matching templates and which represent potential template coverage gaps. Built for...

CVE-2026-5432-GraphQL-Batching-Alias-Confusion-SQL-Injection

7. CVE-2026-5432 – Iniezione SQL da Confusione di Alias nel Batching GraphQL Panoramica Un resolver GraphQL costruisce dinamicamente le query SQL a partire dagli alias dei campi. Utilizzando il batching e gli alias, un attaccante aggira una allow‑list e inietta SQL. Gravità: Critico Compromission...

CVE-2026-60137

wpsqli - Estrattore SQLi per WordPress CVE-2026-60137 Uno strumento veloce e guidato da menu per l'estrazione di database che sfrutta la vulnerabilità di SQL injection authornotin nel core di WordPress. Questo strumento si concentra esclusivamente sull'enumerazione e sul dump del database,...

CVE-2026-74251

SQL Injection non autenticata tramite filtro attributi in Phoca Cart Phoca Cart ≤ 6.1.6 — Attaccante non autenticato estrae l'intero database tramite injection blind basata sul tempo SOMMARIO I parametri di tipo array a attributo e s specifica della richiesta GET nella pagina pubblica degli...

PT-2026-106418

Unauthenticated Cross Site Scripting XSS in Database for CF7 = 1.2.6 versions...

PT-2026-106779

Name of the Vulnerable Software and Affected Versions Payload versions 3.0.0 through 3.89.9 Payload versions 4.0.0-canary.0 through 4.0.0-canary.33 Description A user capable of querying a collection with a polymorphic join to sensitive fields can infer hidden or read-restricted values, such as...

PT-2026-107197

SQL injection vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow a low-privileged authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to run arbitra...

PT-2026-107194

Name of the Vulnerable Software and Affected Versions ClearPass Policy Manager affected versions not specified Description A SQL injection flaw exists in the web-based management interface of ClearPass Policy Manager. This issue allows an authenticated remote attacker to execute arbitrary databas...

PT-2026-107209

Name of the Vulnerable Software and Affected Versions ClearPass Policy Manager affected versions not specified Description A SQL injection flaw exists in the API of ClearPass Policy Manager. This issue allows a remote authenticated attacker with administrative privileges to perform SQL injection...