10 matches found
CVE-2026-39492
CVE-2026-39492 — WP Maps Blind SQL Injection Scanner Pre-Auth Time-Based Blind SQLi via Backtick Bypass → DB Extraction Overview CVE-2026-39492 is a critical-severity CVSS 9.3 unauthenticated blind SQL injection vulnerability in the WP Maps plugin wp-google-map-plugin versions ≤ 4.9.1. The...
CVE-2026-54646 CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.php
CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablename values into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE statements without validating the identifiers or escaping embedded backticks. An authenticated...
CVE-2026-54646
CubeCart (an ecommerce platform) is affected by a SQL identifier injection in admin/sources/maintenance.index.inc.php (line 551) prior to 6.7.5 . Administrator-supplied table names from POST parameters are wrapped in backticks and placed into structural SQL statements (ALTER TABLE, CHECK TABLE, A...
CVE-2026-54646 CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.php
CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablename values into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE statements without validating the identifiers or escaping embedded backticks. An authenticated...
CVE-2026-54646 CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.php
CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablename values into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE statements without validating the identifiers or escaping embedded backticks. An authenticated...
GHSA-79CW-HFCC-7MW9 Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes
Summary An authenticated user extracts the admin password hash and any other database content through a time-based blind SQL injection in the DateFilter column key parameter. The POST /pimcore-studio/api/website-settings endpoint and 11 other listing endpoints accepts a columnFilters array where...
Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection
Summary The terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to shellexec. After the fix for GHSA-9643-6xjp-vx57 which added $ to the blocklist, the characters | single pipe, backtick, and the newline byte 0x0A remain...
PT-2026-60674
Summary The terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to shell exec. After the fix for GHSA-9643-6xjp-vx57 which added $ to the blocklist, the characters | single pipe, backtick, and the newline byte 0x0A remain...
PT-2026-60697
Name of the Vulnerable Software and Affected Versions Pheditor versions 2.0.1 through 2.0.5 Description The terminal feature in Pheditor contains a flaw in how it sanitizes user-supplied commands before passing them to the shell exec function. While a blocklist is used to filter dangerous...
