157 matches found
WeGIA < 3.6.5 - Unauthenticated Authentication Bypass via extract()
WeGIA 3.6.5 contains an authentication bypass caused by unsafe use of extract on $REQUEST, letting unauthenticated attackers bypass authentication and access protected areas, exploit requires no authentication. id: CVE-2026-28411 info: name: WeGIA 3.6.5 - Unauthenticated Authentication Bypass via...
CVE-2022-34265
CVE-2022-34265 CVE-2022-34265 के लिए PoC विवरण Django 3.2 में 3.2.14 से पहले और 4.0 में 4.0.6 से पहले एक समस्या पाई गई। Trunc और Extract डेटाबेस फ़ंक्शन SQL इंजेक्शन के अधीन हैं यदि अविश्वसनीय डेटा को kind/lookupname मान के रूप में उपयोग किया जाता है। वे एप्लिकेशन जो lookup name और kind choice को...
CVE-2022-34265
CVE-2022-34265 ملخص الثغرة هذه الثغرة ناتجة عن معالجة غير صحيحة للسلاسل النصية عند تنفيذ SQL لوسائط الدالتين Trunc و Extract المستخدمتين لبيانات التاريخ في Django. من خلال تحديد معاملات الطلب كما هي في وسيط kind الخاص بـ Trunc أو وسيط lookupname الخاص بـ Extract، هناك خطر من تنفيذ عبارات SQL...
CVE-2026-87115
The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for unauthenticated attackers to delete arbitrary files...
CVE-2026-87115 VikAppointments Services Booking Calendar <= 1.2.21 - Unauthenticated Arbitrary File Deletion via 'old_vapcfN' Parameter
The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for unauthenticated attackers to delete arbitrary files...
CVE-2026-87115
The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to unauthenticated arbitrary file deletion in all versions up to and including 1.2.21 . The root cause is insufficient file path validation within the extract function, specifically involving the old_vapcfN parameter...
EUVD-2026-91958
The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for unauthenticated attackers to delete arbitrary files...
CVE-2026-87115 VikAppointments Services Booking Calendar <= 1.2.21 - Unauthenticated Arbitrary File Deletion via 'old_vapcfN' Parameter
The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for unauthenticated attackers to delete arbitrary files...
CVE-2026-87115: Improper Limitation of a Pathname to a Restricted Directory
The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for unauthenticated attackers to delete arbitrary files...
ROS-20261002-73-0035
The vulnerability of the EXTRACT function in the PostgreSQL database management system is related to the lack of protective measures for SQL query structures. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...
Astra Linux – Vulnerability in Python-Django
A issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc and Extract database functions are vulnerable to SQL injection if untrusted data is used as a kind/lookupname value. Applications that restrict the choice of lookup names and kinds to a known safe list are not...
CVE-2026-16759 Tutor LMS <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutorcoursefilterajax AJAX action. This is due to missing authorization on the handler...
The vulnerability of the EXTRACT() function in the PostgreSQL database management system allows a hacker to execute arbitrary code.
The vulnerability of the EXTRACT function in the PostgreSQL database management system is related to the lack of protective measures for SQL query structures. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...
BIT-POSTGRESQL-2026-15741 PostgreSQL expression deparse allows SQL injection via EXTRACT argument
SQL injection in PostgreSQL EXTRACT deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pgdump, psql commands like \sf, and any similar usage in non-core tools. Versions before...
SUSE CVE-2026-15741
SQL injection in PostgreSQL EXTRACT deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pgdump, psql commands like \sf, and any similar usage in non-core tools. Versions before...
CVE-2026-15741 PostgreSQL expression deparse allows SQL injection via EXTRACT argument
SQL injection in PostgreSQL EXTRACT deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pgdump, psql commands like \sf, and any similar usage in non-core tools. Versions before...
Path Traversal
unzipper is vulnerable to Path Traversal. The vulnerability is due to insufficient path validation in the Extract function, allowing crafted archive paths to escape the intended extraction directory and access or overwrite files outside it...
CVE-2026-51295
Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
PT-2026-66527
SQLite 3.41 is vulnerable to use after free in the jsonExtractFunc function. Premature release of parsed JSON object memory leads to subsequent illegal access of freed pointer. Remote attackers can trigger this flaw via specially crafted SQL queries, resulting in service crash and sensitive memor...