182 matches found
CVE-2026-65761
CVE-2026-65761 — EasyStore Joomla 認証前SQLインジェクション filtersortby 方向 → ORDER BY インジェクション → 全DB読み取り 概要 CVE-2026-65761 （CVSS 9.3 Critical）は、JoomShaper製 EasyStore for Joomla における 未認証SQLインジェクション であり、バージョン ≤ 2.0.1 に影響します。 製品一覧パラメータ filtersortby は、列と方向に分割されます。列は許可リストに対して検証されますが、方向は ASC/DESC の制限なしに SQL のORD...
CVE-2025-29529
SQLi ITC Multiplan CVE-2025-29529 発見 2025年2月21日、クライアントエンゲージメント中にITC Systemsが開発した「Multiplan」プラットフォームにおいてSQLインジェクションの脆弱性が特定されました。 影響を受けるバージョン この脆弱性はv3.7.4.1002でのみテストされています。 攻撃ベクトル...
CVE-2026-26980
CVE-2026-26980 — 👻 Ghost CMS の Content API 経由の未認証 SQLi Ghost の Content API に SQL インジェクションの脆弱性が存在し、認証されていない攻撃者がデータベースから任意のデータを読み取ることが可能でした。...
CVE-2026-26980-PoC
CVE-2026-26980 — Ghost CMS Content API ブラインドSQLインジェクション 影響を受けるバージョン: Ghost 3.24.0 – 6.19.0 修正バージョン: Ghost 6.19.1 必要な認証: なし — Content API キーは公開 影響: データベース全体の未認証読み取り 認証情報、API キー 脆弱性 slug-filter-order.js は、ユーザー指定のスラッグ値をパラメータ化されたバインドを使用せずに、生の SQL ORDER BY 句に直接展開します。 root@kitploit: // VULNERABLE — Gho...
CVE-2026-88854
CVE-2026-88854 — OrdaSoft Joomla Gallery SQL 注入 针对 Joomla 的 OrdaSoft OS Responsive Image Gallery 中 CVE-2026-88854 的 Python 3 PoC 扫描器/漏洞利用工具。 | ---|--- 组件| comosgallery, comosgallerylight 受影响版本| 1.0.0 – 6.2.6 修复版本| 6.2.7+ CVSS 4.0| 9.3 （严重） 认证| 无（公开的 modosgallerysearch） CWE| CWE-89 概述...
Exploit for CVE-2026-88854
CVE-2026-88854 — OrdaSoft Joomla Gallery SQL Injection Python...
CVE-2026-88854
Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla getVar, which is not a real Joomla filter method and falls through to a filter that strips HTML tags but does not touch quotes or SQL syntax. The value is concatenated directly into a...
CVE-2026-88854 Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7
Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla getVar, which is not a real Joomla filter method and falls through to a filter that strips HTML tags but does not touch quotes or SQL syntax. The value is concatenated directly into a...
CVE-2026-88854 Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7
Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla getVar, which is not a real Joomla filter method and falls through to a filter that strips HTML tags but does not touch quotes or SQL syntax. The value is concatenated directly into a...
EUVD-2026-83767
Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla getVar, which is not a real Joomla filter method and falls through to a filter that strips HTML tags but does not touch quotes or SQL syntax. The value is concatenated directly into a...
CVE-2023-54399
Hongjing e-HR before 8.2 contains a SQL injection vulnerability in the /servlet/codesettree endpoint where the categories query parameter is passed to a database query without sanitization after HRMS-encoding is stripped. An unauthenticated remote attacker can supply a crafted UNION SELECT payloa...
CVE-2026-87963
The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthenticated attackers to perform SQL injection and read arbitrary database...
CVE-2026-87963 Yo 1.1 - 1.3.1 - Unauthenticated SQL Injection via username Parameter
The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthenticated attackers to perform SQL injection and read arbitrary database...
CVE-2026-76425 Cisco ISE SQL Injection Vulnerability
A vulnerability in the APIs of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks against the backend database. This vulnerability is due to insufficient validation of certain parameters that are concatenated directly into an SQL query. An attacker could...
October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls
A vulnerability was identified in the Twig sandbox security policy that allowed a chained bypass when cms.safemode is enabled. The Laravel session store was exposed to Twig with unrestricted method access, and raw SQL methods reachable through Eloquent's call forwarding were not blocked across th...
CVE-2026-89180
EFence developed by Thinking Software Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents...
CVE-2026-89180
EFence , developed by Thinking Software Technology , contains a SQL Injection vulnerability that allows unauthenticated remote attackers to inject arbitrary SQL commands and read database contents . The vulnerability requires no user interaction and can be exploited over the network with low comp...
CVE-2026-89180 Thinking Software Technology｜EFence - SQL Injection
EFence developed by Thinking Software Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents...
CVE-2026-89180 Thinking Software Technology｜EFence - SQL Injection
EFence developed by Thinking Software Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents...