6401 matches found
CVE-2026-105856 Payload: SQL injection in SQLite/Postgres
Payload is a free and open source headless content management system. Prior to 3.90.0 and 4.0.0-canary.34, an attacker with read and create or update access to a collection containing a json field or a blocks field with blocksAsJSON enabled can inject SQL through a crafted field path and operator...
CVE-2026-105845
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query readable collections through dynamic filters or joins can submit a request that causes SQL injection in the SQLite...
GHSA-V49J-62M6-PGRR Payload: SQL Injection in SQLite and Postgres
Impact A user can submit a request that exploits a SQL Injection vulnerability in Payload. You are affected if: - You use an affected Payload version. - Untrusted users can query readable collections using dynamic filters or joins. You are not affected if you use MongoDB @payloadcms/mongodb...
Payload: SQL Injection in SQLite and Postgres
Impact A user can submit a request that exploits a SQL Injection vulnerability in Payload. You are affected if: - You use an affected Payload version. - Untrusted users can query readable collections using dynamic filters or joins. You are not affected if you use MongoDB @payloadcms/mongodb...
CVE-2026-105845
The Payload headless content management system is vulnerable to SQL injection in its SQLite and Postgres adapters. This vulnerability affects versions 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27 . An untrusted user capable of querying readable collections via dynamic filters or...
CVE-2026-105845 Payload: SQL Injection in SQLite and Postgres
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query readable collections through dynamic filters or joins can submit a request that causes SQL injection in the SQLite...
CVE-2026-105845 Payload: SQL Injection in SQLite and Postgres
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query readable collections through dynamic filters or joins can submit a request that causes SQL injection in the SQLite...
CVE-2026-105845 Payload: SQL Injection in SQLite and Postgres
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query readable collections through dynamic filters or joins can submit a request that causes SQL injection in the SQLite...
EUVD-2026-93471
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query readable collections through dynamic filters or joins can submit a request that causes SQL injection in the SQLite...
blindxss-lite
blindxss-lite 一个使用 Flask 构建的轻量级 Blind XSS（跨站脚本）收集器和 payload 服务器。它提供一个 JavaScript payload，用于捕获受害者浏览器数据（cookies、localStorage、DOM 片段等），并将其转发到由 HTTP Basic Auth 保护的 SQLite 后端仪表盘。 功能特性 Payload 投递 — /p.js 提供一个自包含的 JS payload，使用 sendBeacon 或 fetch 收集端点 — POST /c（JSON/FormData）和 GET /c.gif（兼容 CSP 的像素信标）...
gryph
AI 编码代理没有安全边界。Gryph 正在构建一个。 每个人都在运行 YOLO 模式。Gryph 强制执行护栏并保留审计追踪。 快速开始 · 演示 · 支持的代理 · 使用场景 · 安全策略 AI 编码代理（Claude Code、Cursor、Windsurf、Gemini CLI、OpenCode）可以读取任何文件、写入任何位置，并在开发者机器上执行任意命令。它们每个会话会运行数十次工具调用。它们能做什么没有边界，出问题时也没有审计追踪。 Gryph 解决了这个问题。 它挂钩到代理中，实时强制执行 block、warn 或 guide 操作的 YAML 策略规则，并将每个事件记录到...
nuclei-cve-analyzer
Nuclei CVE Analyzer A fast CLI tool for analyzing CVE coverage in Nuclei templates. Nuclei CVE Analyzer takes a list of CVE IDs, scans a local Nuclei template repository, and determines which CVEs already have matching templates and which represent potential template coverage gaps. Built for...
[SECURITY] Fedora 45 Update: ocaml-sqlite-5.4.2-1.fc45
SQLite 3 database library wrapper for OCaml...
PT-2026-106777
Name of the Vulnerable Software and Affected Versions Payload versions 3.0.0 through 3.87.9 Payload versions 4.0.0-canary.0 through 4.0.0-canary.26 Description An untrusted user can trigger SQL injection in the SQLite and Postgres adapters by submitting requests that query readable collections...
CVE-2024-34226
访客管理系统 1.0 提交者：Kha Do 漏洞 SQL注入 描述 SourceCodester Visitor Management System 1.0 中的 /php-sqlite-vms/?page=managevisitor&id=1 存在 SQL 注入漏洞，攻击者可通过 id 参数执行任意 SQL 命令。 受影响组件 路径 URL：/php-sqlite-vms/?page=managevisitor&id=1 参数：& id=在此注入 影响 该漏洞允许攻击者通过 id 参数执行任意 SQL 命令 POC 当使用错误条件 1' and '1'='2 搜索国家时，未返回任何结果...
CVE-2025-26794
CVE-2025-26794: Exim 4.98（SQLite DBM）中的盲SQL注入 - 漏洞利用分析 Exim 报告：https://www.exim.org/static/doc/security/CVE-2025-26794.txt 我通过手动代码审查发现了此漏洞。 漏洞详细信息： 问题 当 SQLite 被用作 DBM 时，SQL 参数未正确转义。这导致远程用户有可能构造自定义的 SQLite 查询。 前提条件： 使用“USESQLITE = yes”编译 Exim。这将把 SQLite 设为数据库管理器（DBM）。 启用 ETRN...
CVE-2024-32002-PoC
CVE-2024-32002-PoC CVE-2024-32002 的概念验证 主仓库（用于克隆）：https://github.com/th4s1s/better-sqlite 钩子仓库（用于钩子）：https://github.com/th4s1s/hook...
Astra Linux – Vulnerability in SQLite3
SQLite 3.30.1 improperly handles pExpr-y.pTab, as demonstrated by the TKCOLUMN case in sqlite3ExprCodeTarget in expr.c...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: nfsd: returns -EINVAL when namelen is 0 When we have a corrupted main.sqlite file in /var/lib/nfs/nfsdcld/, it may result in namelen being 0, which will cause memdupuser to return ZEROSIZEPTR. When we access the name.data that ha...