CVE-2024-7928

CVE-2024-7928: Уязвимость произвольного чтения файлов в FastAdmin V1.3.4.20220530 Инструмент CVEHunter для обнаружения уязвимости и эксплуатации с целью получения данных БД для экземпляров FastAdmin для CVE-2024-7928, отличающийся точностью и асинхронной конкурентностью по сравнению с другими PoC...

CVE-2025-69295

CVE-2025-69295 — TeconceTheme Coven Core 盲SQL注入漏洞 CVE-2025-69295 是一个影响 TeconceTheme Coven Core WordPress 主题中 Coven Core 组件的 SQL 注入漏洞。该漏洞源于在将用户提供的输入用于 SQL 查询之前未能正确进行中和处理，从而允许攻击者将恶意的 SQL 命令注入后端数据库查询。 该漏洞特指盲SQL注入，攻击者可以通过发送精心构造的请求并分析响应时间或行为差异等间接响应，从数据库中提取敏感信息。 技术细节 该漏洞的发生是因为输入参数在传入 SQL...

CVE-2024-7928

CVE-2024-7928 POC pour CVE-2024-7928. Tentera de récupérer les détails de la base de données pour les instances FastAdmin. Comment utiliser FOFA : app="FASTADMIN" Installer les dépendances du script : root@kitploit: pip install -r requirements.txt Cible unique : root@kitploit: python...

CVE-2024-7928

CVE-2024-7928 POC pour CVE-2024-7928. Tentative de récupération des détails de la base de données pour les instances FastAdmin. Aperçu Il s'agit d'un outil de balayage et d'exploitation en masse pour CVE-2024-7928 : FastAdmin jusqu'à la version 1.3.3.20220121 permet à des attaquants non...

CVE-2024-34472

CVE-2024-34472 Описание: Аутентифицированный пользователь может использовать уязвимость Blind SQL-инъекции, существующую в файле mliRealtimeEmails.php. Параметр ordemGrid в POST-запросе к /mailinspector/mliRealtimeEmails.php не обеспечивает должной санитизации ввода, что позволяет...

PT-2026-70154

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools = label creator permission to execute arbitrary SQL via the image name field of a patron card layout. The image name value is stored verbatim in the layout XML...

CVE-2026-12987

The Events Manager WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using No-User-Account Booking Mode: a booker-supplied registration field is stored as booking meta and later deserialized without restricting allowed classes, enabling PHP object injection...

EUVD-2026-41057

Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in media.php line 17: SELECT id, filename, extension, type, duration, owner, private FROM files where id = '".$GET'id'."'. An authenticated attacker can perform error-based SQL injection to extract...

CVE-2017-20244 Wow Forms WordPress Plugin 2.1 SQL Injection

Wow Forms WordPress Plugin version 2.1 contains an SQL injection vulnerability that allows unauthenticated attackers to read arbitrary database information by exploiting an unescaped POST parameter. Attackers can inject SQL code through the 'mwpformid' parameter in requests to the admin-ajax.php...

CVE-2018-25411

CVE-2018-25411 affects MGB OpenSource Guestbook 0.7.0.2. The vulnerability is an SQL injection in the email.php endpoint vulnerable to crafted payloads via the id parameter, allowing unauthenticated attackers to execute arbitrary SQL and potentially enumerate database tables and columns. The issu...

CVE-2018-25411 MGB OpenSource Guestbook 0.7.0.2 SQL Injection via email.php

MGB OpenSource Guestbook 0.7.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send GET requests to email.php with crafted SQL payloads in the 'id' parameter to...

MB Connect Line mbCONNECT24和MB Connect Line mymbCONNECT24 SQL注入漏洞

MB Connect Line mbCONNECT24 and MB Connect Line mymb CONNECTION24 are products of the German company MB Connect Line. MB Connect Line mbCONNECT24 is a remote service portal. This product supports features such as remote access, data recording, and alerts. MB Connect Line mymb CONNECTION24 is an...

CVE-2026-42871

WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, atendido/familiardocfamiliar.php displays an overly descriptive error message, including database-related details. This verbosity leads to information disclosure, which could assist a potential attacker in mapping the...

EUVD-2026-29186

WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, atendido/familiardocfamiliar.php displays an overly descriptive error message, including database-related details. This verbosity leads to information disclosure, which could assist a potential attacker in mapping the...

CVE-2026-32321

ClipBucket v5 is an open source video sharing platform. An authenticated time-based blind SQL injection vulnerability exists in ClipBucket prior to 5.5.3 80 within the actions/ajax.php endpoint. Due to insufficient input sanitization of the userid parameter, an authenticated attacker can execute...

EUVD-2026-12960

ClipBucket v5 is an open source video sharing platform. An authenticated time-based blind SQL injection vulnerability exists in ClipBucket prior to 5.5.3 80 within the actions/ajax.php endpoint. Due to insufficient input sanitization of the userid parameter, an authenticated attacker can execute...

PT-2026-26155

ClipBucket v5 is an open source video sharing platform. An authenticated time-based blind SQL injection vulnerability exists in ClipBucket prior to 5.5.3 80 within the actions/ajax.php endpoint. Due to insufficient input sanitization of the userid parameter, an authenticated attacker can execute...

📄 WordPress Backup Migration 1.3.7 Database Disclosure

WordPress Backup Migration plugin version 1.3.7 allows unauthenticated users to access sensitive backup files, potentially exposing the full database and website content. An attacker can retrieve backup archives without authentication...

Fleet has an SQL Injection vulnerability via backtick escape in ORDER BY parameter

Summary A SQL Injection vulnerability in Fleet’s software versions API allowed authenticated users to inject arbitrary SQL expressions via the orderkey query parameter. Due to unsafe use of goqu.I when constructing the ORDER BY clause, specially crafted input could escape identifier quoting and b...

CVE-2019-25462

Web Ofisi Rent a Car v3 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'klima' parameter. Attackers can send GET requests to with malicious 'klima' values to extract sensitive database information or...