94 matches found
cve-2023-27372
education purpose only!!!!!...
CVE-2026-61518
A flaw was found in ISPConfig. A remote API user with low-privilege permissions can exploit an authenticated SQL injection vulnerability in the Remote API. This occurs because the primaryid parameter is directly used in SQL queries without proper validation. An attacker can leverage this to delet...
Samba AD authenticated LDAP access domain takeover
Description Samba AD stores internal database configuration in LDB special records such as @MODULES and @PARTITION. These records are not directory objects and should never be writable by a normal LDAP client. An authenticated low-privilege domain user can nevertheless modify them through LDAP. T...
PT-2026-59208
Summary In Kiwi TCMS the fields TestCase.extra link and TestPlan.extra link were meant to represent URLs to external resources however in versions prior to 16.1 user input was not being sanitized and values were rendered verbatim which represents an opportunity for cross-site scripting...
CVE-2026-27181 MajorDoMo Unauthenticated Module Uninstall via Market Endpoint
MajorDoMo aka Major Domestic Module allows unauthenticated arbitrary module uninstallation through the market module. The market module's admin method reads gr'mode' from $REQUEST and assigns it to $this-mode at the start of execution, making all mode-gated code paths reachable without...
PT-2026-20517
MajorDoMo aka Major Domestic Module allows unauthenticated arbitrary module uninstallation through the market module. The market module's admin method reads gr'mode' from $ REQUEST and assigns it to $this-mode at the start of execution, making all mode-gated code paths reachable without...
The vulnerability of the OU History Report component of the Windows Active Directory management and reporting software Zoho ManageEngine ADAudit Plus allows a malicious actor to execute custom requests and gain access to the database table records.
The vulnerability of the OU History Report component of the Windows Active Directory management and reporting software Zoho ManageEngine ADAudit Plus relates to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute...
CVE-2025-14168
CVE-2025-14168 concerns the WordPress plugin WP DB Booster. The issue is a Cross-Site Request Forgery (CSRF) vulnerability on the cleanup_all AJAX action, present in versions up to and including 1.0.1. The flaw allows unauthenticated attackers to trigger actions that delete database records such ...
CVE-2025-14168: Cross-Site Request Forgery (CSRF)
The WP DB Booster plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing nonce validation on the cleanupall AJAX action. This makes it possible for unauthenticated attackers to delete database records including post...
CVE-2025-67896
Exim before 4.99.1, with certain non-default rate-limit configurations, allows a remote heap-based buffer overflow because database records are cast directly to internal structures without validation...
CVE-2025-67896: Heap-based Buffer Overflow
Exim before 4.99.1, with certain non-default rate-limit configurations, allows a remote heap-based buffer overflow because database records are cast directly to internal structures without validation...
GHSA-9449-RPHM-MJQR AzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCE
An API endpoint that is intended for internal use by the SFTP software sftpgo was mistakenly exposed to the public-facing HTTP API for AzuraCast installations. This would allow a user with specific internal knowledge of a station's operations to craft a custom HTTP request that would affect the...
SQL Injection
melisplatform/melis-cms is vulnerable to SQL injection.The vulnerability is due to improper validation of the idPage parameter in the /melis/MelisCms/PageEdition/getTinyTemplates endpoint, which allows an attacker to retrieve, create, update, or delete database records through crafted SQL queries...
CVE-2025-31997
HCL Unica Centralized Offer Management is vulnerable to Insecure Direct Object References IDOR. An attacker can bypass authorization and access resources in the system directly, for example database records or files...
CVE-2025-31997: Authorization Bypass Through User-Controlled Key
HCL Unica Centralized Offer Management is vulnerable to Insecure Direct Object References IDOR. An attacker can bypass authorization and access resources in the system directly, for example database records or files...
EUVD-2015-5454
Malware in sbrugna...
EUVD-2020-15541
Malware in sbrugna...
EUVD-2020-0407
Malware in sbrugna...