exploit-code-db

README This README would normally document whatever steps a...

CVE-2026-69240

A flaw was found in Sequelize. When configured to use an Oracle database, the Sequelize Node.js Object-Relational Mapper ORM tool fails to properly escape certain date and timestamp values. This oversight allows a remote attacker to bypass security filters. By injecting malicious SQL commands, an...

Attackers Compile khunt Inside Oracle to Turn SQL Injection Into Windows SYSTEM Access

Attackers broke into an organization's Oracle database through a SQL injection flaw in a public-facing web application, then installed a post-exploitation toolkit without writing an executable to disk. They fed Java source code to the database, let Oracle compile it into stored schema objects, an...

Security Bulletin: Multiple security vulnerabilities have been identified in IBM Db2 shipped with IBM Guardium Key Lifecycle Manager (SKLM/GKLM)

Summary IBM Db2 is shipped as a component of IBM Guardium Key Lifecycle Manager SKLM/GKLM. Information about multiple security vulnerabilities affecting IBM Db2 has been published in security bulletins. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

WordPress TableOn – WordPress Posts Table Filterable  plugin <= 1.0.5.1 - Unauthenticated Blind SQL Injection vulnerability

Unauthenticated Blind SQL Injection vulnerability discovered by Athiwat Tiprasaharn Jitlada, Itthidej Aramsri Boeing777, Waris Damkham in WordPress Plugin TableOn versions = 1.0.5.1...

CVE-2026-19020

The CVE concerns itsourcecode Hospital Management System 1.0. The vulnerability lies in the file /servicetype.php, where manipulation of the editid parameter enables SQL injection. This affects remote attackers and public PoCs exist, indicating exploitable conditions. CVSS data across versions in...

CVE-2026-19020

A weakness has been identified in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /servicetype.php. This manipulation of the argument editid causes sql injection. It is possible to initiate the attack remotely. The exploit has be...

WordPress User Access Manager plugin <= 2.3.12 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Nox Axter in WordPress Plugin User Access Manager versions = 2.3.12...

CVE-2026-12713 WPCargo Track & Trace < 8.0.4 - Unauthenticated SQL Injection via wpcargo_tracking_number

The WPCargo Track & Trace WordPress plugin before 8.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks. This affects a code path distinct from the one addressed by CVE-2024-44004...

RLSA-2026:49621 Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Site isolation issue in the DOM: Navigation component CVE-2026-15719 firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component CVE-2026-15718 firefox: thunderbird: Mitigation...

thunderbird security update

An update is available for thunderbird. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Mozilla Thunderbird is a standalone mail and newsgroup client. Security...

PT-2026-68828

Name of the Vulnerable Software and Affected Versions Azure SQL Database affected versions not specified Description Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network. Recommendations At the moment, there is no information about a...

PT-2026-68755

Name of the Vulnerable Software and Affected Versions Ground Station versions prior to 0.6.0 Description An unauthenticated database-destruction and arbitrary-data-injection issue exists in the Socket.IO server's database backup event handler. Due to disabled authentication enforcement and a...

PT-2026-68587

Name of the Vulnerable Software and Affected Versions Garbage Collector Database Cleanup versions prior to 0.15 Description An unauthenticated Cross Site Request Forgery CSRF issue exists in the Garbage Collector Database Cleanup plugin. CSRF is a flaw that allows an attacker to trick a victim in...

PT-2026-68775

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.5 Description Authenticated workspace members can perform unauthorized document store operations due to missing authorization on mutation endpoints. Users with view-level permissions can send direct HTTP requests ...

PT-2026-69354

Name of the Vulnerable Software and Affected Versions Term Pages WordPress plugin versions prior to 2.0.0 Description Unauthenticated attackers can perform SQL injection attacks because the plugin fails to properly sanitize and escape a user-supplied parameter before incorporating it into a SQL...

CVE-2026-53984: Missing Authentication for Critical Function

Ground Station prior to 0.6.0 contains an unauthenticated database-destruction and arbitrary-data-injection vulnerability in the Socket.IO server's databasebackup event handler that allows any unauthenticated network peer to wipe or replace the entire SQLite database by sending a single fullresto...

CVE-2026-66686: Cross-Site Request Forgery (CSRF)

Unauthenticated Cross Site Request Forgery CSRF in Plugins Garbage Collector Database Cleanup = 0.14 versions...

PT-2026-68677

Name of the Vulnerable Software and Affected Versions itsourcecode Hospital Management System version 1.0 Description A SQL injection flaw exists in the /viewappointment.php file. A remote attacker can exploit this by manipulating the delid argument, allowing for unauthorized database queries...

EulerOS 2.0 SP13 : sqlite (EulerOS-SA-2026-3001)

According to the versions of the sqlite packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a...