PT-2026-64836

The Custom Fields Account Registration For Woocommerce WordPress plugin before 1.4 does not prevent its custom registration fields from writing to the user capabilities meta key on sites that use a non-default database table prefix, so an unauthenticated user who registers an account can be grant...

CVE-2021-32086

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. It uses a hardcoded symmetric encryption key to encrypt secrets in the MySQL databases. This key is not unique for each installation. An attacker that gains access to the MySQL server or a backup files can decrypt th...

ROS-20260727-73-0006

A vulnerability in the MariaDB database management system is related to incorrect behavior. Exploitation of this vulnerability could allow a remote attacker to cause a denial of service...

PT-2026-64928

Unauthenticated SQL Injection in Relevanssi Light = 1.2.2 versions...

CVE-2026-56747: Improper Control of Generation of Code

Improper control of generation of code in the JSON Pointer-to-accessor compiler in Cribl Stream before 4.18.2 allows a remote authenticated attacker with edit privileges to execute arbitrary JavaScript on the server via a crafted database connection identifier or pack configuration value...

PT-2026-65104

Improper control of generation of code in the JSON Pointer-to-accessor compiler in Cribl Stream before 4.18.2 allows a remote authenticated attacker with edit privileges to execute arbitrary JavaScript on the server via a crafted database connection identifier or pack configuration value...

Linux Distros Unpatched Vulnerability : CVE-2026-13068

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database,...

Web-Payloads-Arsenal

🔥 SQL Injection Payloads Arsenal My daily collection of SQL...

CVE-2026-61128

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are MySQL Server: 9.7.0-9.7.1; MySQL Cluster: 9.7.0-9.7.1. Easily exploitable vulnerability allows high privileg...

[SECURITY] Fedora 44 Update: GitPython-3.1.55-1.fc44

GitPython is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing. It provides abstractions of git objects for easy access of repository data, a nd additionally allows you to access the git repository more directly using eith er a...

sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5

A flaw was found in SQLite, specifically within its FTS5 full-text search extension. Attackers can exploit a heap-based buffer overflow by providing a specially crafted database. This crafted database contains malicious metadata that triggers an integer underflow during FTS5 MATCH query processin...

sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data

A flaw was found in SQLite's FTS5 full-text search extension. This vulnerability involves memory corruption, specifically an out-of-bounds read and a heap buffer overflow, which can be triggered by supplying a crafted database with malformed FTS5 page data. When an FTS5 MATCH query is executed...

GHSA-XX22-P4CH-683R vulnerabilities

Vulnerabilities for packages: spark, debezium-connector-ibmi, debezium, zipkin, confluent-kafka, cassandra-reaper, debezium-connector-vitess, cassandra, debezium-connector-spanner, debezium-connector-informix, apache-pulsar, kafka, thingsboard, apache-nifi, debezium-connector-db2,...

[SECURITY] Fedora 44 Update: netatalk-4.5.1-1.fc44

Netatalk is a freely-available Open Source AFP file server. A NIX/BSD system running Netatalk is capable of serving many Macintosh clients simultaneously as an AppleShare file server AFP. In addition to the AFP file server daemon, the following utility programs are also included: ad - AppleDouble...

SUSE CVE-2026-64245

In the Linux kernel, the following vulnerability has been resolved: fbdev: modedb: fix a possible UAF in fbfindmode If modeoption is NULL, it is assigned from modeoptionbuf: if !modeoption fbgetoptionsNULL, &modeoptionbuf; modeoption = modeoptionbuf; Later, name is assigned from modeoption: const...

openSUSE 16: libshibsp-lite12 / libshibsp12 / shibboleth-sp / etc (openSUSE-SU-2026:21418-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21418-1 advisory. This update for shibboleth-sp fixes the following issue - CVE-2025-9943: SQL injection in the ID attribute of the SAML response when the replay cache of...

GHSA-CMWH-G2H8-C222 Poweradmin: OIDC `sub` collation bypass in Poweradmin leading to account takeover

Preface Poweradmin maps OIDC identities into local users through oidcuserlinks.oidcsubject plus providerid. In the MySQL schema, the OIDC link table explicitly uses utf8mb4unicodeci, which is case-insensitive and accent-insensitive. OIDC sub is a stable external subject identifier and should be...

GHSA-PMPG-2MXQ-6XWR Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete

Summary An end-user injection in Budibase's MongoDB datasource lets any BASIC app user bypass the builder's query-level access controls. Builders scope MongoDB reads per-user with bindings like "email": " currentUser.email " so each app user only sees their own rows. Because the binding is...

GHSA-QW6M-8FW2-2V64 Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query Execution

Summary Budibase's MongoDB query execution endpoint POST /api/v2/queries/:queryId is vulnerable to NoSQL injection through user-supplied query parameters. The enrichContext function interpolates parameter values into JSON query templates using Handlebars with noEscaping: true, then parses the...

SQL Injection

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to SQL Injection via the multipleStatements configuration in the MySQL integration. An attacker can execute arbitrary SQL commands by injecting malicious input into user fields, potentially leading...