95448 matches found
CVE-2026-72589 alseambusher crontab-ui - Unauthenticated RCE via Shell Injection in Imported Database hook Field
An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to execute arbitrary system commands by importing a crafted crontab database file. The POST /import endpoint accepts arbitrary .db files and overwrites the application database...
CVE-2026-72589
An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to execute arbitrary system commands by importing a crafted crontab database file. The POST /import endpoint accepts arbitrary .db files and overwrites the application database...
CVE-2026-72589
An OS command injection vulnerability affects alseambusher/crontab-ui up to version 0.4.2. An unauthenticated remote attacker can trigger arbitrary system commands by importing a crafted crontab database file via POST /import, which accepts arbitrary .db files and overwrites the application datab...
CVE-2026-72589 alseambusher crontab-ui - Unauthenticated RCE via Shell Injection in Imported Database hook Field
An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to execute arbitrary system commands by importing a crafted crontab database file. The POST /import endpoint accepts arbitrary .db files and overwrites the application database...
CVE-2026-72589 alseambusher crontab-ui - Unauthenticated RCE via Shell Injection in Imported Database hook Field
An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to execute arbitrary system commands by importing a crafted crontab database file. The POST /import endpoint accepts arbitrary .db files and overwrites the application database...
CVE-2026-42537 Apache Ranger: Remote Code Execution via JDBC URL Injection
Remote Code Execution via JDBC URL Injection in Apache Ranger = 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue...
CVE-2026-16949
The Term Pages WordPress plugin before 2.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks...
phpMyFAQ - Unauth Config Backup Detection (CVE-2025-69200)
phpMyFAQ = 4.1.0-RC / 4.0.16 allows unauthenticated POST /api/setup/backup to generate and expose a configuration ZIP containing database credentials CVE-2025-69200 / GHSA-9cg9-4h4f-j6fg. !/usr/bin/env python3 -- coding: utf-8 -- """phpMyFAQ unauthenticated config backup via /api/setup/backup...
Magento - local.xml Config Disclosure Detection
Detects exposed Magento /app/etc/local.xml containing database username/password. !/usr/bin/env python3 -- coding: utf-8 -- """Magento app/etc/local.xml configuration disclosure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info ...
CVE-2026-19049
The ProSolution WP Client WordPress plugin before 2.0.9 does not sanitise a cookie value before using it in SQL queries, and processes that cookie on every request without any authentication or capability check, allowing unauthenticated users to read arbitrary data from the database and to delete...
EUVD-2026-55015
The Term Pages WordPress plugin before 2.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks...
CVE-2026-18666
The Library Management System WordPress plugin before 3.6.7 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing users with a role as low as Subscriber to perform SQL injection and extract arbitrary data from the database, including user password...
Important: Red Hat Security Advisory: postgresql security update
An update for postgresql is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...
CVE-2026-19384
A weakness has been identified in SourceCodester Simple Doctors Appointment System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=setappointment. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has...
CVE-2026-19384 SourceCodester Simple Doctors Appointment System ajax.php set_appointment sql injection
A weakness has been identified in SourceCodester Simple Doctors Appointment System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=setappointment. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has...
CVE-2026-72900: Missing Authorization
Metabase allows an authenticated, low-privileged attacker to read the entire Metabase application database...
CVE-2026-72862: Improper Neutralization of Special Elements used in an OS Command
Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the mariadb.ts, mongo.ts, mysql.ts, postgres.ts, redis.ts, and libsql.ts Dokploy database service deployment functions pass user-controlled dockerImage fields unquoted into docker pull $dockerImage shell commands on th...
CVE-2026-72878: Improper Neutralization of Special Elements used in an OS Command
Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy's backup and restore pipeline constructs shell commands by directly interpolating user-controlled database fields into bash -c "..." and sh -c "..." strings, then executes them via childprocess.exec. An...
PT-2026-69845
Name of the Vulnerable Software and Affected Versions ReadyEcommerce versions prior to 4.5.2 Description An unauthenticated SQL injection exists in the product listing API. The issue occurs because the rating parameter in the 'products' endpoint is concatenated directly into a MySQL HAVING clause...