twint

TWINT - Herramienta de Inteligencia de Twitter Sin autenticación. Sin API. Sin límites. Twint es una herramienta avanzada de scraping de Twitter escrita en Python que permite extraer Tweets de perfiles de Twitter sin usar la API de Twitter. Twint utiliza los operadores de búsqueda de Twitter para...

blind-sql-bitshifting

Inyección SQL Ciega mediante Desplazamiento de Bits Este es un módulo que realiza inyección SQL ciega utilizando el método de desplazamiento de bits para calcular caracteres en lugar de adivinarlos. Requiere 7/8 solicitudes por carácter, dependiendo de la configuración. Uso import...

PT-2026-108909

ProcessMaker is an open source workflow management software suite. Prior to 2026.14.3, the GET /api/1.0/tasks endpoint in ProcessMaker is vulnerable to SQL injection through the order by parameter because ProcessMakerTraitsTaskControllerIndexMethods::applyColumnOrdering concatenates a...

EUVD-2026-94803

SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable to blind attacks based on Boolean, error, time-based and UNION techniques. Exploitation allows attacke...

CVE-2026-101153

On affected versions of CloudVision Portal on-premises or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user with sufficient high privileges could exploit this to extract unintended data from the Sensor...

CVE-2026-101153 Security Advisory 0188

On affected versions of CloudVision Portal on-premises or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user with sufficient high privileges could exploit this to extract unintended data from the Sensor...

CVE-2026-101153

A path traversal vulnerability exists in CloudVision Portal (on-premises) and CloudVision Sensor . An authenticated user with high privileges could exploit this flaw to extract unintended data from the Sensor. The vulnerability is associated with CWE-22 (Improper Limitation of a Pathname to a Res...

Security Advisory 0188

Security Advisory 0188 . CSAF PDF Date: October 6, 2026 Revision | Date | Changes ---|---|--- 1.0 | October 6, 2026 | Initial release 1.1 | October 13, 2026 | Updated Resolution section to include the 2026.3.0 release The CVE-ID tracking this issue: CVE-2026-101153 CVSSv3.1 Base Score: 8.0...

CVE-2026-71298

A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the orderBy query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extraction of data from the database...

CVE-2026-71298 Maestro: sql identifier injection via properties.* search filter and orderby field

A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the orderBy query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extraction of data from the database...

CVE-2026-71298 Maestro: sql identifier injection via properties.* search filter and orderby field

A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the orderBy query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extraction of data from the database...

CVE-2026-71298

A SQL injection vulnerability exists in maestro within the orderBy query parameter of its REST API list endpoints. This flaw allows a remote attacker to perform read-only blind extraction of data from the database without authentication. To mitigate this risk, users should restrict network access...

EUVD-2026-92757

A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the orderBy query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extraction of data from the database...

CVE-2026-71298

A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the orderBy query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extraction of data from the database. Mitigation To mitigate this...

PT-2026-106190

A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the orderBy query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extraction of data from the database...

Cross-Lingual Transferability of Training Data Extraction Attacks to Recover Memorized PII

The robustness of Personally Identifiable Information PII protection in Large Language Models LLMs is a critical concern, yet the risks associated with cross-lingual data extraction remain under-explored. This study evaluates the vulnerability of English-centric and multilingual models to Trainin...

EUVD-2026-91943

The SaveTo Wishlist Lite WordPress plugin before 1.1.5 does not sanitise and escape parameters before using them in the ORDER BY clause of a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database...

CVE-2026-89236

The SaveTo Wishlist Lite WordPress plugin, in versions prior to 1.1.5 , is vulnerable to SQL Injection . The root cause is the failure to sanitize and escape parameters used within the ORDER BY clause of a SQL query, specifically through the 'sort_column' and 'sort_order' parameters. This allows ...

CVE-2026-94539 SupportCandy <= 3.5.3 - Authenticated (Custom+) SQL Injection via 'sort_by' Parameter

The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to time-based SQL Injection via the 'sortby' parameter in all versions up to, and including, 3.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-103766

ClipBucket versions v5 through 5.5.3-#197 are vulnerable to an SQL injection vulnerability. The issue resides in the admin_area/ads_manager.php file, where authenticated users with ad_manager_access permissions can inject SQL via the delete parameter . By supplying time-based blind payloads conca...