153 matches found
WeGIA < 3.6.5 - Unauthenticated Authentication Bypass via extract()
WeGIA 3.6.5 contains an authentication bypass caused by unsafe use of extract on $REQUEST, letting unauthenticated attackers bypass authentication and access protected areas, exploit requires no authentication. id: CVE-2026-28411 info: name: WeGIA 3.6.5 - Unauthenticated Authentication Bypass via...
CVE-2022-34265
CVE-2022-34265 CVE-2022-34265 的 PoC 描述 在 Django 3.2（3.2.14 之前）和 4.0（4.0.6 之前）版本中发现了一个问题。如果将不受信任的数据用作 kind/lookupname 值，Trunc 和 Extract 数据库函数会受到 SQL 注入的影响。将查找名称和种类选择限制在已知安全列表内的应用程序不受影响。 使用方法 启动 git clone https://github.com/ZhaoQi99/CVE-2022-34265.git cd CVE-2022-34265 docker-compose up -d 移除...
CVE-2022-34265
CVE-2022-34265 脆弱性の概要 この脆弱性は、Djangoで日付データに使用される関数TruncとExtractの引数において、SQLを実行する際の不適切な文字列処理に起因します。Truncのkind引数、またはExtractのlookupname引数にリクエストパラメータがそのまま指定されることで、任意のSQL文が実行されるリスクがあります。この脆弱性を悪用すると、第三者がデータベースにコマンドを送信して、許可されていないデータにアクセスしたり、データベースを削除したりする可能性があります。...
CVE-2026-87115
The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for unauthenticated attackers to delete arbitrary files...
EUVD-2026-91958
The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for unauthenticated attackers to delete arbitrary files...
CVE-2026-87115
The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to unauthenticated arbitrary file deletion in all versions up to and including 1.2.21 . The root cause is insufficient file path validation within the extract function, specifically involving the old_vapcfN parameter...
CVE-2026-87115 VikAppointments Services Booking Calendar <= 1.2.21 - Unauthenticated Arbitrary File Deletion via 'old_vapcfN' Parameter
The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for unauthenticated attackers to delete arbitrary files...
ROS-20261002-73-0035
The vulnerability of the EXTRACT function in the PostgreSQL database management system is related to the lack of protective measures for SQL query structures. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...
Astra Linux – Vulnerability in Python-Django
A issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc and Extract database functions are vulnerable to SQL injection if untrusted data is used as a kind/lookupname value. Applications that restrict the choice of lookup names and kinds to a known safe list are not...
CVE-2026-16759 Tutor LMS <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutorcoursefilterajax AJAX action. This is due to missing authorization on the handler...
The vulnerability of the EXTRACT() function in the PostgreSQL database management system allows a hacker to execute arbitrary code.
The vulnerability of the EXTRACT function in the PostgreSQL database management system is related to the lack of protective measures for SQL query structures. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...
BIT-POSTGRESQL-2026-15741 PostgreSQL expression deparse allows SQL injection via EXTRACT argument
SQL injection in PostgreSQL EXTRACT deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pgdump, psql commands like \sf, and any similar usage in non-core tools. Versions before...
SUSE CVE-2026-15741
SQL injection in PostgreSQL EXTRACT deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pgdump, psql commands like \sf, and any similar usage in non-core tools. Versions before...
CVE-2026-15741 PostgreSQL expression deparse allows SQL injection via EXTRACT argument
SQL injection in PostgreSQL EXTRACT deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pgdump, psql commands like \sf, and any similar usage in non-core tools. Versions before...
CVE-2026-51295
Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
PT-2026-66527
SQLite 3.41 is vulnerable to use after free in the jsonExtractFunc function. Premature release of parsed JSON object memory leads to subsequent illegal access of freed pointer. Remote attackers can trigger this flaw via specially crafted SQL queries, resulting in service crash and sensitive memor...
CVE-2026-17514
A vulnerability was determined in ZJONSSON node-unzipper up to 0.12.3. Affected by this vulnerability is the function Extract of the file lib/extract.js. This manipulation causes path traversal. The attack requires local access. The exploit has been publicly disclosed and may be utilized. The...
CVE-2026-17514 ZJONSSON node-unzipper extract.js Extract path traversal
A vulnerability was determined in ZJONSSON node-unzipper up to 0.12.3. Affected by this vulnerability is the function Extract of the file lib/extract.js. This manipulation causes path traversal. The attack requires local access. The exploit has been publicly disclosed and may be utilized. The...