sqlmap

sqlmap sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switche...

CVE-2026-5432-GraphQL-Batching-Alias-Confusion-SQL-Injection

7. CVE-2026-5432 – GraphQL Batching Alias Confusion SQL Injection Overview A GraphQL resolver constructs SQL queries dynamically from field aliases. By using batching and aliases, an attacker bypasses an allow‑list and injects SQL. Severity: Critical Database Takeover Node.js Server & Exploit //...

w3af

sqlmap sqlmap es una herramienta para pruebas de penetración "penetration testing" de software libre que automatiza el proceso de detección y explotación de fallos mediante inyección de SQL además de tomar el control de servidores de bases de datos. Contiene un poderoso motor de detección, así co...

chusa

chusa: 注射 Chusa - 注射 is an open source penetration testing tool based on SQLmap that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a...

CVE-2026-54596: Improper Neutralization of Special Elements used in an SQL Command

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated Technician or higher with access to at least one client invoice can inject SQL through the frequency parameter handled by...

CVE-2026-73847: Cross-Site Request Forgery (CSRF)

Emlog is an open source website building system. In 2.6.26 and earlier, missing CSRF protection on the AI Assistant executetool action in admin/ai.php lets a remote unauthenticated attacker submit a forged cross-site request from an attacker-controlled page to a recently logged-in administrator...

Exploit for CVE-2026-5432

--- 7. CVE-2026-5432 – GraphQL Batching Alias Confusion SQL...

CVE-2026-60406

Vulnerability in the TimesTen In-Memory Database product of Oracle TimesTen In-Memory Database component: Kubernetes Operator. The supported version that is affected is 26.1.1.1.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where TimesTen...

PT-2026-62488

Name of the Vulnerable Software and Affected Versions Oracle TimesTen In-Memory Database version 26.1.1.1.0 Description A flaw in the Kubernetes Operator component allows a high-privileged attacker with access to the infrastructure where the database executes to compromise the system. Successful...

CVE-2026-55500 9router: Exposure of Sensitive Information and Unprotected Database Import/Export Allows Complete Credential Theft and Database Takeover

9Router is an AI router & token saver. Prior to 0.4.80, the /api/settings/database endpoint allows full database export containing all credentials, API keys, OAuth tokens, and settings and full database import complete overwrite without any authentication requirement beyond the ALWAYSPROTECTED...

NPM: 9routers has Exposure of Sensitive Information and Unprotected Database Import/Export, Allowing Complete Credential Theft and Database Takeover

NPM: 9routers has Exposure of Sensitive Information and Unprotected Database Import/Export, Allowing Complete Credential Theft and Database Takeover vulnerability discovered by ? in WordPress Npm 9router versions = 0.4.71...

CVE-2026-36962

The open-source application development framework MuuCMF T6 v1.9.4.20260115 is vulnerable to an SQL Injection via the keyword parameter in the /index/controller/Search.php endpoint. This flaw allows an unauthenticated attacker to compromise the entire database, gain unauthorized administrative ac...

CVE-2026-32950 SQLBot: RCE via SQL Injection in Excel Upload Endpoint

SQLBot is an intelligent data query system based on a large language model and RAG. Versions prior to 1.7.0 contain a critical SQL Injection vulnerability in the /api/v1/datasource/uploadExcel endpoint that enables Remote Code Execution RCE, allowing any authenticated user even the...

Unspecified Vulnerability in Oracle Database Server (CNVD-2025-24087)

Oracle Database Server is a set of relational database management system of the United States Oracle Oracle. The database management system provides data management, distributed processing and other functions. Oracle Database Server's Oracle Database has a security vulnerability that can be...

CVE-2025-30751

Vulnerability in the Oracle Database component of Oracle Database Server. Supported versions that are affected are 19.27 and 23.4-23.8. Easily exploitable vulnerability allows low privileged attacker having Create Session, Create Procedure privilege with network access via Oracle Net to compromis...

CVE-2025-30751: Incorrect Authorization

Vulnerability in the Oracle Database component of Oracle Database Server. Supported versions that are affected are 19.27 and 23.4-23.8. Easily exploitable vulnerability allows low privileged attacker having Create Session, Create Procedure privilege with network access via Oracle Net to compromis...

Oracle Database Server 安全漏洞

Oracle Database Server is a set of relational database management system of the United States Oracle Oracle. The database management system provides data management, distributed processing and other functions. Oracle Database Server's Oracle Database has a security vulnerability that can be...

CVE-2021-2328

Vulnerability in the Oracle Text component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Easily exploitable vulnerability allows high privileged attacker having Create Any Procedure, Alter Any Table privilege with network access via Oracle Net to...

CVE-2022-21410

Vulnerability in the Oracle Database - Enterprise Edition Sharding component of Oracle Database Server. The supported version that is affected is 19c. Easily exploitable vulnerability allows high privileged attacker having Create Any Procedure privilege with network access via Oracle Net to...

WordPress WP Rocket < 2.10.3 - Local File Inclusion Vulnerability

Paulos Yibelo discovered and reported this Local File Inclusion vulnerability in WordPress WP Rocket Plugin. This could allow a malicious actor to include local files of the target website and show its output onto the screen. Files which store credentials, such as database credentials, could...