CVE-2025-2812

CVE-2025-2812 — Mydata Bilişim Ltd. Şti 製「Bilet Satış Otomasyonu」におけるSQLインジェクションの脆弱性 📌 CVE-ID: CVE-2025-2812 📢 USOM 通知: tr-25-0099 🛡️ 脆弱性タイプ: CWE-89 - SQL Injection Boolean-based Blind 🏢 影響を受ける製品: Bilet Satış Otomasyonu – Mydata Bilişim Ltd. Şti 🌐 対象URL例:...

CVE-2026-79303

CVE-2026-79303 布尔型盲注（Boolean-blind SQL injection） 描述 ：动态 SQL 语句的生成未进行必要的数据验证，也未使用参数化语句或存储过程。 影响 ：SQL 注入（SQLi） CVSSv3.1 向量 ：AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H（9.9 严重 ） CWE ：CWE-89：SQL 命令中特殊元素中和不当（'SQL 注入'） 受影响组件 ：GET 参数 orderby 和 orderdirection 厂商 ：kaiten 受影响产品 kaiten 版本：57.192.20 C 发现者 Danil Bel...

CVE-2026-28576-poc

CVE-2026-28576：Android 通讯录提供程序中的 SQL 注入 选中一个联系人，泄露全部联系人：一个 targetSdk 兼容性开关将单联系人选择器授权变成完整的通讯录数据库泄露。 Android 17 通过 setStrictColumns / setStrictGrammar 强化了通讯录提供程序以抵御 SQL 注入——但该强化措施被置于一个受 targetSdk 限制的兼容性变更之后（ENFORCESTRICTSQLCHECKS，id 484953293，enableAfterTargetSdk="36"）。任何以 SDK 36...

CVE-2026-52770

YesWiki , a PHP-based wiki system, is affected by an unauthenticated SQL injection in its public Bazar entry-listing APIs prior to version 4.6.6 . The root cause lies in SearchManager::buildQueriesConditions(), where attacker-controlled numeric query/queries filter values are escaped with mysqli_...

CVE-2026-75417

A SQL injection vulnerability was found in YzmCMS 7.5. The issue occurs in the getarrchildid function within application/admin/controller/category.class.php, where the user-controlled parentid parameter is concatenated directly into a FINDINSET SQL clause without proper sanitization. This allows ...

CVE-2026-75417

A SQL injection vulnerability was found in YzmCMS 7.5. The issue occurs in the getarrchildid function within application/admin/controller/category.class.php, where the user-controlled parentid parameter is concatenated directly into a FINDINSET SQL clause without proper sanitization. This allows ...

CVE-2026-75417

A SQL injection vulnerability exists in YzmCMS 7.5 within the get_arrchildid() function located in application/admin/controller/category.class.php. The flaw arises because the user-controlled parentid parameter is concatenated directly into a FIND_IN_SET() SQL clause without sufficient sanitizati...

CVE-2026-40524

FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the getgltransactions function where the filtertype parameter is concatenated directly into a SQL IN clause without parameterization. Attackers with SAGLANALYTIC permission can inject arbitrary SQL by supplying a closing...

CVE-2026-47378: Authorization Bypass Through User-Controlled Key

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, Public shared-view endpoints exposed values from columns that the view owner had hidden, via three independent paths: groupBy returned raw values for any column named in the request, filter and sort arrays operated on...

EUVD-2026-37552

The JetEngine plugin for WordPress is vulnerable to SQL injection in all versions up to and including 3.8.10.1. The listingloadmore AJAX handler accepts a filteredquery parameter that is intentionally excluded from the HMAC query signature check to support front-end filter integration. However,...

CVE-2026-12360

The JetEngine plugin for WordPress is vulnerable to SQL injection in all versions up to and including 3.8.10.1. The listingloadmore AJAX handler accepts a filteredquery parameter that is intentionally excluded from the HMAC query signature check to support front-end filter integration. However,...

CVE-2026-45418 ClipBucket: Blind SQL Injection in subtitle_edit.php

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - 132, any authenticated user who can upload videos can add multiple subtitles from different files and change their title English, Spanish.... The POST /actions/subtitleedit.php request used to change their title...

PT-2026-48792

Name of the Vulnerable Software and Affected Versions ClipBucket v5 versions prior to 5.5.3 Description An authenticated user with video upload privileges can exploit a boolean-based blind SQL injection, a technique where data is exfiltrated by observing true or false responses from the server. T...

Spring Data Relational: Attackers can supply wildcard characters to perform boolean-based blind data inference

Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher STARTING, ENDING, or CONTAINING in Query By Example QBE. An attacker can supply wildcard characters to perform boolean-based blind data inference. Affected versions: Spring Data...

VMware Spring Data Relational 安全漏洞

VMware Spring Data Relational is a relational database access framework developed by VMware, Inc. There is a security vulnerability in VMware Spring Data Relational, which stems from the improper escaping of external control inputs when using StringMatcher in Query By Example. Attackers can use...

Exploit for CVE-2026-00000

CVE-2026-00000 Boolean-blind SQL injection Description...

Exploit for CVE-2026-79303

CVE-2026-79303 Boolean-blind SQL injection Description...

CVE-2017-20246 KittyCatfish 2.2 Plugin for WordPress SQL Injection

KittyCatfish 2.2 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to read database contents by exploiting an unescaped GET parameter. Attackers can inject SQL code through the 'kcad' parameter in base.css.php or kittycatfish.php to extract sensiti...

CVE-2017-20246 KittyCatfish 2.2 Plugin for WordPress SQL Injection

KittyCatfish 2.2 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to read database contents by exploiting an unescaped GET parameter. Attackers can inject SQL code through the 'kcad' parameter in base.css.php or kittycatfish.php to extract sensiti...

PT-2026-47769

Name of the Vulnerable Software and Affected Versions KittyCatfish version 2.2 Description An SQL injection allows unauthenticated attackers to read database contents by exploiting an unescaped GET parameter. Attackers can inject SQL code through the kc ad parameter in the 'base.css.php' or...