PT-2026-107193

Name of the Vulnerable Software and Affected Versions ClearPass Policy Manager affected versions not specified Description An unauthenticated remote attacker can perform SQL injection attacks against an affected interface of ClearPass Policy Manager. SQL injection is a technique where malicious S...

PT-2026-106779

Name of the Vulnerable Software and Affected Versions Payload versions 3.0.0 through 3.89.9 Payload versions 4.0.0-canary.0 through 4.0.0-canary.33 Description A user capable of querying a collection with a polymorphic join to sensitive fields can infer hidden or read-restricted values, such as...

CVE-2026-49952

Installazione pip3 install Pillow torch torchvision Esecuzione $ python3 exploit.py http://localhost/discuz5/ +----------------------------------------------------+ | Discuz! X5.0 Remote Code Execution Exploit by EgiX | +----------------------------------------------------+ + Getting authcode for...

CVE-2024-42327

writeup CVE-2024-42327 vulnerabilità zabbix bersaglio: 10.129.231.176 Informazioni: So che il mio bersaglio è un server zabbix. Ho ricevuto un account utente predefinito per accedere a zabbix: utente matthew password 96qzn0h2e1k3. Questo account ha un utente predefinito, senza gruppi o privilegi...

CVE-2025-29529

SQLi ITC Multiplan CVE-2025-29529 Scoperta Il 21 febbraio 2025, è stata identificata una vulnerabilità di SQL injection nella piattaforma “Multiplan” sviluppata da ITC Systems durante un impegno con un cliente. Versioni Affette Questa vulnerabilità è stata testata solo sulla versione v3.7.4.1002...

Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute

Impact Multiple @opentelemetry/instrumentation- packages recorded the database connection username as the db.user span attribute on every instrumented database operation. This attribute was emitted unconditionally — it was not gated by enhancedDatabaseReporting or any other opt-in flag, and it wa...

EUVD-2026-91788

Multiple @opentelemetry/instrumentation- packages expose database username via unconditional db.user span attribute...

GHSA-QQMP-WF37-98F9 Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute

Impact Multiple @opentelemetry/instrumentation- packages recorded the database connection username as the db.user span attribute on every instrumented database operation. This attribute was emitted unconditionally — it was not gated by enhancedDatabaseReporting or any other opt-in flag, and it wa...

github.com/moby/sys/user: moby/sys/user: Denial of Service via crafted user or group database files

A flaw was found in the moby/sys/user package. The package does not properly limit memory allocation when parsing Unix-style user and group database files, such as /etc/passwd or /etc/group. An attacker who can supply a specially crafted file can cause excessive memory consumption, leading to a...

github.com/moby/sys/user: moby/sys/user: Denial of Service via crafted user or group database files

A flaw was found in the moby/sys/user package. The package does not properly limit memory allocation when parsing Unix-style user and group database files, such as /etc/passwd or /etc/group. An attacker who can supply a specially crafted file can cause excessive memory consumption, leading to a...

lighthouse

Lighthouse - A Coverage Explorer for Reverse Engineers Overview Lighthouse is a powerful code coverage explorer for IDA Pro and Binary Ninja, providing software researchers with uniquely interactive controls to study execution maps for native applications without requiring symbols or source. This...

cvedb

CVEdb CVEdb è un'ulteriore libreria e utilità Python per database CVE. Ce ne sono già molte disponibili. Perché crearne un'altra? La maggior parte delle librerie esistenti si affida a API di terze parti come cve.circl.lu, che possono e di fatto limitano l'utilizzo, richiedono registrazione e/o...

CVE-2024-1301---Badgermeter-moni-tool-SQL-Injection

CVE-2024-1301 --- Badgermeter moni tool - SQL Injection https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-badger-meters-monitool CVE-2024-1301: 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CWE-89. Software link : https://www.s-can.at/en/product/monitool/...

CVE-2023-49954.github.io

SQL Injection nell'Integrazione CRM di 3CX Per l'integrazione CRM, 3CX fornisce dei template per connettersi a vari database. In questi template, i placeholder FirstName,SearchText,Email vengono utilizzati per popolare le query. L'input dell'utente non viene sanificato e quindi abilita iniezioni...

DBconfigReader

Vulnerabilità di divulgazione delle informazioni di configurazione del database nell'interfaccia del sistema OA ecology di Weaver /mobile/DBconfigReader.jsp http://x.x.x.x:8090/mobile/DBconfigReader.jsp Analisi del codice Fortify rileva - algoritmo di crittografia debole SecretKey key =...

oracleShell

oracleShell Oracle 数据库命令执行 Ambiente di test - privilegi DBA： SELECT FROM v$version Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - Production PL/SQL Release 11.2.0.1.0 - Production "CORE 11.2.0.1.0 Production" TNS for 32-bit Windows: Version 11.2.0.1.0 - Production NLSRTL Version...

CVE-2026-88424

FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter. This vulnerability allows attackers to access sensitive database information via crafted SQL statements...

CVE-2022-24716

CVE-2022-24716 Beliebige Datei-Offenlegungsschwachstelle in Icinga Web 2 2.8.6, 2.9.6, 2.10 Icinga Web 2 ist eine Open-Source-Überwachungs-Weboberfläche, ein Framework und eine Befehlszeilenschnittstelle. Nicht authentifizierte Benutzer können den Inhalt von Dateien des lokalen Systems einsehen,...

CVE-2026-75855

Titolo Path Traversal nei comandi server "create database" / "drop database" consente scrittura ed eliminazione arbitraria di file al di fuori della directory database configurata Riepilogo I comandi create database e drop database dell'endpoint POST /api/v1/server utilizzano il nome del database...

CVE-2023-43339-CMSmadesimple-Reflected-XSS---Installation

Cmsmadesimple CMS Reflected XSS v2.2.18 Autore: Sergio Descrizione: Multiple vulnerabilità Cross-Site Scripting XSS nell'installazione di cmsmadesimple v.2.2.18 permettono a un attaccante locale di eseguire script web arbitrari tramite un payload manipolato iniettato nel Nome del Database, Utente...