xpath

xpath 用于授权安全测试的高级 XPath 注入扫描器。 由 Chokri Hammedi blue0x1 编写 · MIT 许可 概述 xpath 是一个使用 Nim 编写的快速、多技术 XPath 注入扫描器。它专注于实际检测、响应比较、可见提取、盲提取，以及针对真实世界 XML 支持应用的负载覆盖。 它除了 Nim 标准库外没有外部运行时依赖。 能力...

exploit-cve-2023-36808

CVE-2023-36808 - Inyección SQL no autenticada en GLPI Vulnerabilidad Las versiones de GLPI se inyecta directamente en una consulta SQL sin sanitización: root@kitploit: SELECT id FROM glpiagents WHERE deviceid = '' No se requiere autenticación. La vulnerabilidad permite acceso de lectura completo ...

CVE-2026-78070

plgcontentdpcalendar 中的 ORDER BY 短代码 SQL 注入 DPCalendar Free ≤ 10.11.2 — 作者级用户通过基于时间的盲注提取完整数据库 摘要 plgcontentdpcalendar 内容插件会解析嵌入在 Joomla 文章正文中的 events order="..."/events 短代码。order 参数值被直接传递给 EventsModel::setState'list.ordering', ...，完全绕过了模型自身的 populateState 白名单。该值随后被插入到 SQL ORDER BY 子句中，仅受...

CVE-2026-56096

The extension passes the user-supplied search query parameter to Apache Solr without restricting advanced Solr query syntax such as wildcards, field selectors and range queries. A remote, unauthenticated attacker can use this syntax to enumerate indexed field names and extract their stored values...

EUVD-2026-65349

The extension passes the user-supplied search query parameter to Apache Solr without restricting advanced Solr query syntax such as wildcards, field selectors and range queries. A remote, unauthenticated attacker can use this syntax to enumerate indexed field names and extract their stored values...

CVE-2026-56096

CVE-2026-56096 is an information disclosure vulnerability in the "Apache Solr for TYPO3 - Enterprise Search" extension (identifier: solr). The extension passes a user-supplied search query parameter directly to Apache Solr without restricting advanced Solr query syntax such as wildcards, field se...

CVE-2026-56096 Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)

The extension passes the user-supplied search query parameter to Apache Solr without restricting advanced Solr query syntax such as wildcards, field selectors and range queries. A remote, unauthenticated attacker can use this syntax to enumerate indexed field names and extract their stored values...

CVE-2026-56096 Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)

The extension passes the user-supplied search query parameter to Apache Solr without restricting advanced Solr query syntax such as wildcards, field selectors and range queries. A remote, unauthenticated attacker can use this syntax to enumerate indexed field names and extract their stored values...

CVE-2026-40524

FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the getgltransactions function where the filtertype parameter is concatenated directly into a SQL IN clause without parameterization. Attackers with SAGLANALYTIC permission can inject arbitrary SQL by supplying a closing...

CVE-2025-71332

Flowise 2.2.7 contains a SQL injection in the importChatflows API triggered by unsanitized chatflow.id in a JSON import file. An authenticated user can craft the id field so it is concatenated into a SQL IN clause, enabling arbitrary SQL execution and extraction of data from the credential table ...

TypiCMS-Search-LIKE-Wildcard-Info-Disclosure

TypiCMS Search LIKE Wildcard Information Disclosure A proof-o...

CVE-2018-25339

Zechat 1.5 contains a SQL injection vulnerability in the v parameter that enables unauthenticated attackers to extract database information via time-based blind techniques. Exploitation can be performed to confirm vulnerability and retrieve data, indicating potential impact to confidentiality. Th...

CVE-2026-28562

wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::gettopics where the ORDER BY clause relies on ineffective escsql sanitization on unquoted identifiers. Attackers exploit the wpfob parameter with CASE WHEN payloads to perform blind boolean extraction of credentials...

CVE-2026-28562

wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::gettopics where the ORDER BY clause relies on ineffective escsql sanitization on unquoted identifiers. Attackers exploit the wpfob parameter with CASE WHEN payloads to perform blind boolean extraction of credentials...

CVE-2026-28562

CVE-2026-28562 affects wpForo 2.4.14. The vulnerability is an unauthenticated SQL injection in Topics::get_topics(), where the ORDER BY clause relies on insufficient esc_sql() sanitization for unquoted identifiers. An attacker can craft wpfob payloads (e.g., using CASE WHEN) to perform blind bool...

CVE-2019-25457

Web Ofisi Firma v13 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'oz' array parameter. Attackers can send GET requests to category pages with malicious 'oz' values using time-based blind SQL injectio...

PT-2026-6738

RimbaLinux AhadPOS 1.11 contains a SQL injection vulnerability in the 'alamatCustomer' parameter that allows attackers to manipulate database queries through crafted POST requests. Attackers can exploit time-based and boolean-based blind SQL injection techniques to extract information or...