CVE-2022-24124

POC for CVE-2022-24124 Exploit Code for CVE-2022-24124 aka Casdoor SQL Injection Exploit Links: ExploitDB-50792 PacketStormSecurity Expected outcome: Dump SQL database version on host running Casdoor 1.13.1 Intended only for educational and testing in corporate environments. Exploit Usage...

CVE-2026-12265

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations...

CVE-2024-56428

CVE-2024-56428 Cleartext credentials in local database of the iLabClient Read out the configuration incl. password The iLabClient is used to download the results from the laboratory server. The configuration data are stored locally in the Apache Derby instance iLabClient. The password is stored i...

Cisco-UCM-SQLi-Scripts

Scripts de CVE-2019-15972 Cisco UCM SQLi Scripts que se pueden usar para explotar CVE-2019-15972, un problema de SQLi autenticado en Cisco Unified Call Manager UCM. Enumerar tablas - enumera todas las tablas en la base de datos subyacente y coloca los nombres de las tablas en un archivo de texto...

WordPress File Manager plugin 7.2.2-8.0.4 - Unauthenticated Database Backup Disclosure vulnerability

Unauthenticated Database Backup Disclosure vulnerability discovered by Jakub Herman in WordPress Plugin File Manager versions 7.2.2-8.0.4...

CVE-2024-51747

CVE-2024-51747 Log in with an administrator account and download the database in the system settings Modify projecthasfiles in the sqlite.db database Compress the modified sqlite.db with gzip and upload it. After uploading it to the project and clicking the file to view/download, the attacker can...

Wordpress-cve-CVE-2022-21661

Wordpress 5.8.2 CVE-2022-21661 Vuln enviroment This enviroment is setup with the Elementor Custom Skin, plugin to test the CVE-2022-21661. to start the enviroment console wp-lab$ ./start.sh To get the admin password get the log from the running container, a new pwd is generated every time the...

EUVD-2026-88237

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations...

CVE-2026-12265 Missing Authorization on HA Failover Config allows Complete Data Destruction

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations...

CVE-2026-12265

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to an insufficient access control flaw in the HA failover endpoint . This vulnerability allows an attacker to perform destructive PostgreSQL database operations , potentially leading to complete data destruction. The vulnerabil...

NanoMQ-Memory-Leak-Research

CVE-2026-36590: Denial of Service in EMQ NanoMQ v0.24.9 This repository contains the public advisory and technical analysis for CVE-2026-36590, a denial-of-service vulnerability affecting EMQ NanoMQ v0.24.9. Review Note This repository is public to provide an accessible technical reference for CV...

CVE-2026-48842

CVE-2026-48842 PoC — Roundcube virtuserquery pre-auth SQLi Poc for CVE-2026-48842 , a pre-auth SQL injection in the optional virtuserquery plugin of Roundcube Webmail. The tool does two things and refuses to guess about either: 1. Confirms the injection with a true/false differential not a single...

CVE-2026-101007

A vulnerability has been found in aaPanel BaoTa up to 11.8.0. This issue affects the function InputSql of the file class/database.py of the component Database Backup Handler. Such manipulation of the argument Password leads to os command injection. The attack can be executed remotely. The exploit...

CVE-2025-56819

CVE-2025-56819 An issue in Datart v.1.0.0-rc.3 allows a remote attacker to execute arbitrary code via the INIT connection parameter. POST /api/v1/data-provider/test HTTP/1.1 Host: test.com:8080 Content-Type: application/json Content-Length: 520 "name": "jdbc-data-provider", "type": "JDBC",...

CVE-2021-35576

CVE-2021-35576 CVE-2021-35576 Security Vulnerability to bypass Oracle Unified Audit, details of Proof Of Concept is published here: https://databasesecurityninja.wordpress.com/2022/06/11/cve-2021-35576-bypassing-unified-audit-policy/ CVE details: https://vulners.com/cve/CVE-2021-35576...

CVE-2026-101007 aaPanel BaoTa Database Backup database.py InputSql os command injection

A vulnerability has been found in aaPanel BaoTa up to 11.8.0. This issue affects the function InputSql of the file class/database.py of the component Database Backup Handler. Such manipulation of the argument Password leads to os command injection. The attack can be executed remotely. The exploit...

EUVD-2026-88103

A vulnerability has been found in aaPanel BaoTa up to 11.8.0. This issue affects the function InputSql of the file class/database.py of the component Database Backup Handler. Such manipulation of the argument Password leads to os command injection. The attack can be executed remotely. The exploit...

CVE-2026-101007

A vulnerability exists in aaPanel BaoTa up to version 11.8.0 , specifically within the Database Backup Handler component. The flaw is located in the InputSql function of the class/database.py file. By manipulating the Password argument, an attacker can achieve remote os command injection . Public...

CVE-2026-101007 aaPanel BaoTa Database Backup database.py InputSql os command injection

A vulnerability has been found in aaPanel BaoTa up to 11.8.0. This issue affects the function InputSql of the file class/database.py of the component Database Backup Handler. Such manipulation of the argument Password leads to os command injection. The attack can be executed remotely. The exploit...

CVE-2024-57430

CVE-2024-57430 An SQL injection vulnerability in the pjActionGetUser function of PHPJabbers Cinema Booking System v2.0 allows attackers to manipulate database queries via the column parameter. Exploiting this flaw can lead to unauthorized information disclosure, privilege escalation, or database...