CVE-2021-35042

CVE-2021-35042 Django SQL injection bug Question: explore how exploitable is it? Answer: I'm terrified Install poetry install poetry run ./manage.py migrate poetry run ./manage.py loaddata dummydata.json Interactive Demo poetry run ./manage.py runserver Ordering by random fields go to...

CVE-2021-28079

CVE-2021-28079 - POC Jamovi file example.omv example.omv: Zip archive data, at least v2.0 to extract All OMV files are archived data. So, you can extract it and modify to exploit the XSS bug. 🔥\ unzip example.omv Archive: example.omv inflating: META-INF/MANIFEST.MF inflating: index.html inflating...

WordPress Admin Word Count Column 2.2 - Local File Inclusion

The plugin does not validate the path parameter given to readfile, which could allow unauthenticated attackers to read arbitrary files on server running old version of PHP susceptible to the null byte technique. This could also lead to RCE by using a Phar Deserialization technique. id:...

CVE-2026-110753

A flaw was found in perl-text-csvxs. This flaw allows an attacker who supplies specially crafted CSV input to trigger a Denial of Service DoS. When processing CSV data configured with bound column variables, the parser improperly releases memory references upon encountering empty rows. Subsequent...

CVE-2026-100158

The SQL Chart Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-axis column value $value-$xargs from $wpdb-getresults' parameter in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-102658

The SQL Chart Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-axis column value $value-$xargs from $wpdb-getresults' parameter in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-100158

The SQL Chart Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.0.6 . The root cause is insufficient input sanitization and output escaping within the X-axis column value parameter. An authenticated attacker with Subscriber-level...

CVE-2026-100158 SQL Chart Builder <= 3.0.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SQL Chart Label (X-axis) via Stored User Field

The SQL Chart Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-axis column value $value-$xargs from $wpdb-getresults' parameter in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-78837

CVE-2026-78837 Description An SQL injection vulnerability in the apformid parameter in AppNitro MachForm v30 allows attackers to access sensitive database information via a crafted SQL statement. Affected Component Tested on MachForm - Version 30 Attack Type Remote Attack Vectors An unauthenticat...

CVE-2026-1312

CVE-2026-1312 is a high-severity Django SQL injection vulnerability: when a column alias containing a dot is used in QuerySet.orderby, combined with FilteredRelation dynamically constructing queries via dictionary expansion, an attacker may be able to inject malicious SQL Affected versions:...

CVE-2026-102466

The io.vertx:vertx-mysql-client component in Eclipse Vert.x (versions [4.0.0, 4.5.34] , [5.0.0, 5.0.12] , [5.1.0, 5.1.9] , and [5.2.0, 5.2.0] ) is vulnerable to a denial of service (DoS) attack. The vulnerability exists because the client pre-allocates an array for column definitions based on a s...

EUVD-2026-101960

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the Vert.x DB2 client vertx-db2-client contains DRDA protocol handling code that deserializes User Defined Type UDT column data using a bare ObjectInputStream.readObject call with no ObjectInputFilter or clas...

CVE-2026-17001

The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Column User Meta Profile Fields in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-17001 Import and export users and customers <= 2.4.5 - Authenticated (Custom+) Stored Cross-Site Scripting via User Meta Profile Fields

The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Column User Meta Profile Fields in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

EUVD-2026-101840

The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Column User Meta Profile Fields in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-17001

The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.4.5 . The root cause is insufficient input sanitization and output escaping within the Custom Column User Meta Profile Fields . This allows authe...

CVE-2026-34220

CVE-2026-43220 MikroORM SQL Injection ★ CVE-2026-43220 MikroORM SQL Injection PoC ★ https://github.com/user-attachments/assets/33724cfc-6151-47ff-9415-2f50c5124cd1 Overview CVE-2026-43220 is a SQL Injection vulnerability in MikroORM , a widely used TypeScript/Node.js ORM framework. When a...

PT-2026-113603

The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 0.3.6. This is due to insufficient input sanitization on the public /wp-json/anycomment/v1/subscribe REST endpoint and missing output escaping in...

CVE-2026-52307

CVE-2026-52307: 1CMS v5.6 Authenticated Stored XSS Vulnerability Introduction This repository contains the reproduction of CVE-2026-52307 , an authenticated stored cross-site scripting XSS vulnerability discovered in 1CMS v5.6 formerly ClassCMS. A proof-of-concept PoC is provided to demonstrate t...

CVE-2024-23995

Beekeeper-Studio PoC A Proof-Of-Concept for CVE-2024-23995 vulnerability. 1.Vunerability Overview: Vulnerability Subject: RCE via XSS Vulnerability Version: = Beekeeper-Studio-4.1.13 Attack Type: Remote Code Execution Attack Vectors: To exploit the vulnerability, one must insert malicious scripts...