205 matches found
CVE-2026-88854
CVE-2026-88854 — Injection SQL dans OrdaSoft Joomla Gallery Scanner/exploit PoC en Python 3 pour CVE-2026-88854 dans OrdaSoft OS Responsive Image Gallery pour Joomla. | ---|--- Composant| comosgallery, comosgallerylight Affecté| 1.0.0 – 6.2.6 Corrigé dans| 6.2.7+ CVSS 4.0| 9.3 Critique Auth| Aucu...
CVE-2026-62376 Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access
Vikunja is an open-source self-hosted task management platform. Versions prior to 2.4.0 store password-reset, email-confirmation, and account-deletion tokens in the usertokens table in plaintext. If an attacker gains read access to the database through a backup leak, misconfigured storage, or...
CVE-2026-26980
CVE-2026-26980 ★ CVE-2026-26980 TryGhost Ghost CMS Content API Injection SQL PoC ★ https://github.com/user-attachments/assets/e7fab29e-8382-4ecc-986c-68852c28a32c Aperçu CVE-2026-26980 est une vulnérabilité d'injection SQL non authentifiée dans l'API Content de TryGhost Ghost CMS. Le chemin...
CVE-2026-65761
CVE-2026-65761 — Injection SQL EasyStore Joomla sans authentification Direction filtersortby → Injection ORDER BY → Lecture complète de la base de données Vue d'ensemble CVE-2026-65761 CVSS 9.3 Critique est une injection SQL non authentifiée dans EasyStore pour Joomla de JoomShaper, affectant les...
CVE-2025-29529
SQLi ITC Multiplan CVE-2025-29529 발견 2025년 2월 21일, 고객사 업무 중 ITC Systems가 개발한 "Multiplan" 플랫폼에서 SQL 인젝션 취약점이 확인되었습니다. 영향을 받는 버전 이 취약점은 v3.7.4.1002에서만 테스트되었습니다. 공격 벡터 "ForgotPassword.aspx" 엔드포인트에서 사용되는 "ctl00%24cpLogin%24ctlForgotPassword%24txtEmail" POST 매개변수가 샌니타이즈되지 않은 것으로 확인되었습니다. 인증되지 않은 위협 행위...
CVE-2026-26980
CVE-2026-26980 — 👻 Ghost CMS : injection SQL non authentifiée via Content API Une vulnérabilité d'injection SQL existait dans l'API Content de Ghost, permettant à des attaquants non authentifiés de lire des données arbitraires de la base de données. | ---|--- CVE| CVE-2026-26980 CVSS| 9.4 Critiqu...
CVE-2026-26980-PoC
CVE-2026-26980 — Слепая SQL-инъекция в Content API Ghost CMS Затронутые версии: Ghost 3.24.0 – 6.19.0 Исправлено в: Ghost 6.19.1 Требуется авторизация: Нет — ключ Content API является публичным Воздействие: Неавторизованное чтение всей базы данных учётные данные, ключи API Уязвимость...
intigriti-0926-writeup
Intigriti Challenge 0926 — Critter Gallery: UNION-based SQL In...
Exploit for CVE-2026-88854
CVE-2026-88854 — OrdaSoft Joomla Gallery SQL Injection Python...
CVE-2026-88854
Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla getVar, which is not a real Joomla filter method and falls through to a filter that strips HTML tags but does not touch quotes or SQL syntax. The value is concatenated directly into a...
CVE-2026-88854 Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7
Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla getVar, which is not a real Joomla filter method and falls through to a filter that strips HTML tags but does not touch quotes or SQL syntax. The value is concatenated directly into a...
EUVD-2026-83767
Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla getVar, which is not a real Joomla filter method and falls through to a filter that strips HTML tags but does not touch quotes or SQL syntax. The value is concatenated directly into a...
CVE-2026-88854 Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7
Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla getVar, which is not a real Joomla filter method and falls through to a filter that strips HTML tags but does not touch quotes or SQL syntax. The value is concatenated directly into a...
CVE-2023-54399
Hongjing e-HR before 8.2 contains a SQL injection vulnerability in the /servlet/codesettree endpoint where the categories query parameter is passed to a database query without sanitization after HRMS-encoding is stripped. An unauthenticated remote attacker can supply a crafted UNION SELECT payloa...
CVE-2026-87963
The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthenticated attackers to perform SQL injection and read arbitrary database...
CVE-2026-87963 Yo 1.1 - 1.3.1 - Unauthenticated SQL Injection via username Parameter
The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthenticated attackers to perform SQL injection and read arbitrary database...
CVE-2026-76425 Cisco ISE SQL Injection Vulnerability
A vulnerability in the APIs of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks against the backend database. This vulnerability is due to insufficient validation of certain parameters that are concatenated directly into an SQL query. An attacker could...
October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls
A vulnerability was identified in the Twig sandbox security policy that allowed a chained bypass when cms.safemode is enabled. The Laravel session store was exposed to Twig with unrestricted method access, and raw SQL methods reachable through Eloquent's call forwarding were not blocked across th...