CVE-2026-109170 LogicalDOC Community Edition through 9.3 HQL Injection via documents.xml indexed Parameter

LogicalDOC Community Edition through 9.3 contains an HQL injection vulnerability in DocumentsDataServlet that allows authenticated users to manipulate queries via the unvalidated indexed parameter. Attackers with read access to any folder can inject boolean HQL expressions to bypass folder scope...

EUVD-2026-97447

LogicalDOC Community Edition through 9.3 contains an HQL injection vulnerability in DocumentsDataServlet that allows authenticated users to manipulate queries via the unvalidated indexed parameter. Attackers with read access to any folder can inject boolean HQL expressions to bypass folder scope...

CVE-2026-109170 LogicalDOC Community Edition through 9.3 HQL Injection via documents.xml indexed Parameter

LogicalDOC Community Edition through 9.3 contains an HQL injection vulnerability in DocumentsDataServlet that allows authenticated users to manipulate queries via the unvalidated indexed parameter. Attackers with read access to any folder can inject boolean HQL expressions to bypass folder scope...

CVE-2022-24124

POC for CVE-2022-24124 Exploit Code for CVE-2022-24124 aka Casdoor SQL Injection Exploit Links: ExploitDB-50792 PacketStormSecurity Expected outcome: Dump SQL database version on host running Casdoor 1.13.1 Intended only for educational and testing in corporate environments. Exploit Usage...

CVE-2024-56428

CVE-2024-56428 Cleartext credentials in local database of the iLabClient Read out the configuration incl. password The iLabClient is used to download the results from the laboratory server. The configuration data are stored locally in the Apache Derby instance iLabClient. The password is stored i...

CVE-2024-51747

CVE-2024-51747 Log in with an administrator account and download the database in the system settings Modify projecthasfiles in the sqlite.db database Compress the modified sqlite.db with gzip and upload it. After uploading it to the project and clicking the file to view/download, the attacker can...

Wordpress-cve-CVE-2022-21661

Wordpress 5.8.2 CVE-2022-21661 Vuln enviroment This enviroment is setup with the Elementor Custom Skin, plugin to test the CVE-2022-21661. to start the enviroment console wp-lab$ ./start.sh To get the admin password get the log from the running container, a new pwd is generated every time the...

NanoMQ-Memory-Leak-Research

CVE-2026-36590: Denial of Service in EMQ NanoMQ v0.24.9 This repository contains the public advisory and technical analysis for CVE-2026-36590, a denial-of-service vulnerability affecting EMQ NanoMQ v0.24.9. Review Note This repository is public to provide an accessible technical reference for CV...

CVE-2026-105412

An SQL Injection vulnerability affecting Tuleap Enterprise Edition 17.5 could allow an attacker to have read access the Tuleap database...

EUVD-2026-97332

An SQL Injection vulnerability affecting Tuleap Enterprise Edition 17.5 could allow an attacker to have read access the Tuleap database...

CVE-2026-105412

An SQL Injection vulnerability exists in Tuleap Enterprise Edition 17.5 . This flaw could allow an attacker with LOW privileges to gain read access to the Tuleap database. While the technical root cause is not specified, the vulnerability is categorized under CWE-89 (Improper Neutralization of Sp...

CVE-2026-1907

A SQL Injection SQLi affects the Kong Gateway Enterprise and Open Source clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane CP, leading to potential unauthorized database access. Leveraging the...

CVE-2026-1907

A SQL Injection (SQLi) vulnerability exists in the Kong Gateway (Enterprise and Open Source) clustering communication logic when operating in Hybrid Mode . The flaw is triggered by sending specially crafted RPC requests to the Control Plane (CP) , which could allow an attacker to achieve unauthor...

CVE-2026-1907 SQL Injection in Clustering Communication (Hybrid Mode)

A SQL Injection SQLi affects the Kong Gateway Enterprise and Open Source clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane CP, leading to potential unauthorized database access. Leveraging the...

EUVD-2026-97300

A SQL Injection SQLi affects the Kong Gateway Enterprise and Open Source clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane CP, leading to potential unauthorized database access. Leveraging the...

lighthouse

Lighthouse - A Coverage Explorer for Reverse Engineers Overview Lighthouse is a powerful code coverage explorer for IDA Pro and Binary Ninja, providing software researchers with uniquely interactive controls to study execution maps for native applications without requiring symbols or source. This...

CVE-2025-56819

CVE-2025-56819 An issue in Datart v.1.0.0-rc.3 allows a remote attacker to execute arbitrary code via the INIT connection parameter. POST /api/v1/data-provider/test HTTP/1.1 Host: test.com:8080 Content-Type: application/json Content-Length: 520 "name": "jdbc-data-provider", "type": "JDBC",...

CVE-2021-35576

CVE-2021-35576 CVE-2021-35576 Security Vulnerability to bypass Oracle Unified Audit, details of Proof Of Concept is published here: https://databasesecurityninja.wordpress.com/2022/06/11/cve-2021-35576-bypassing-unified-audit-policy/ CVE details: https://vulners.com/cve/CVE-2021-35576...

CVE-2024-57430

CVE-2024-57430 An SQL injection vulnerability in the pjActionGetUser function of PHPJabbers Cinema Booking System v2.0 allows attackers to manipulate database queries via the column parameter. Exploiting this flaw can lead to unauthorized information disclosure, privilege escalation, or database...

cve-2021-22146

cve-2021-22146 I found during a internal pentest a vulnerability on elastic ECE. Elasticdump is a PoC for CVE-2021-22146 to dump database from elastic ece from 7.10.0 to 7.13.3 https://www.exploit-db.com/exploits/50152 Collaborators: Mario Díaz Caldera...