MAL-2026-13413 Malicious code in @astralcore/aura-wb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd4a1b22725e981c18c44de0f81915a5048b58bdcacfe6935c9dfcb3dceb641c The package is a WhatsApp Baileys bot whose default configuration in config/index.js points MONGODBURI at a hardcoded shared Atlas cluster...

CVE-2026-5134

CVE-2026-5134 describes an SQL injection in Loca Software Informatics Technology Ltd. Co. CMS. Affected as of CMS version up to 06082026. The issue is due to improper neutralization of special elements used in SQL commands (SQLi) and is classified with CVSSv3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:...

CVE-2026-5134

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Loca Software Informatics Technology Ltd. Co. CMS allows SQL Injection. This issue affects CMS: through 06082026. NOTE: The vendor was contacted early about this disclosure but did not respond in a...

WordPress WP Job Portal plugin <= 2.5.6 - SQL Injection vulnerability

SQL Injection vulnerability discovered by dzeusking in WordPress Plugin WP Job Portal versions = 2.5.6...

WordPress Plugins Garbage Collector (Database Cleanup) plugin <= 0.14 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Plugins Garbage Collector Database Cleanup versions = 0.14...

exploit-code-database

The Exploit Database Git Repository This is an official repos...

exploit-code-db

README This README would normally document whatever steps a...

CVE-2026-69240

A flaw was found in Sequelize. When configured to use an Oracle database, the Sequelize Node.js Object-Relational Mapper ORM tool fails to properly escape certain date and timestamp values. This oversight allows a remote attacker to bypass security filters. By injecting malicious SQL commands, an...

Attackers Compile khunt Inside Oracle to Turn SQL Injection Into Windows SYSTEM Access

Attackers broke into an organization's Oracle database through a SQL injection flaw in a public-facing web application, then installed a post-exploitation toolkit without writing an executable to disk. They fed Java source code to the database, let Oracle compile it into stored schema objects, an...

Security Bulletin: Multiple security vulnerabilities have been identified in IBM Db2 shipped with IBM Guardium Key Lifecycle Manager (SKLM/GKLM)

Summary IBM Db2 is shipped as a component of IBM Guardium Key Lifecycle Manager SKLM/GKLM. Information about multiple security vulnerabilities affecting IBM Db2 has been published in security bulletins. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

WordPress TableOn – WordPress Posts Table Filterable  plugin <= 1.0.5.1 - Unauthenticated Blind SQL Injection vulnerability

Unauthenticated Blind SQL Injection vulnerability discovered by Athiwat Tiprasaharn Jitlada, Itthidej Aramsri Boeing777, Waris Damkham in WordPress Plugin TableOn versions = 1.0.5.1...

CVE-2026-19020

A weakness has been identified in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /servicetype.php. This manipulation of the argument editid causes sql injection. It is possible to initiate the attack remotely. The exploit has be...

CVE-2026-19020

The CVE concerns itsourcecode Hospital Management System 1.0. The vulnerability lies in the file /servicetype.php, where manipulation of the editid parameter enables SQL injection. This affects remote attackers and public PoCs exist, indicating exploitable conditions. CVSS data across versions in...

WordPress User Access Manager plugin <= 2.3.12 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Nox Axter in WordPress Plugin User Access Manager versions = 2.3.12...

CVE-2026-12713 WPCargo Track & Trace < 8.0.4 - Unauthenticated SQL Injection via wpcargo_tracking_number

The WPCargo Track & Trace WordPress plugin before 8.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks. This affects a code path distinct from the one addressed by CVE-2024-44004...

RLSA-2026:49621 Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Site isolation issue in the DOM: Navigation component CVE-2026-15719 firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component CVE-2026-15718 firefox: thunderbird: Mitigation...

thunderbird security update

An update is available for thunderbird. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Mozilla Thunderbird is a standalone mail and newsgroup client. Security...

PT-2026-68587

Name of the Vulnerable Software and Affected Versions Garbage Collector Database Cleanup versions prior to 0.15 Description An unauthenticated Cross Site Request Forgery CSRF issue exists in the Garbage Collector Database Cleanup plugin. CSRF is a flaw that allows an attacker to trick a victim in...

CVE-2026-66686: Cross-Site Request Forgery (CSRF)

Unauthenticated Cross Site Request Forgery CSRF in Plugins Garbage Collector Database Cleanup = 0.14 versions...

PT-2026-68775

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.5 Description Authenticated workspace members can perform unauthorized document store operations due to missing authorization on mutation endpoints. Users with view-level permissions can send direct HTTP requests ...