EUVD-2026-69998

Improper Neutralization of Special Elements used in an LDAP Query 'LDAP Injection' vulnerability in Drupal LDAP / Active Directory Integration allows LDAP Injection. This issue affects LDAP / Active Directory Integration versions: from 0.0.0 to 2.2.1...

CVE-2026-81205

CVE-2026-81205 is an LDAP injection vulnerability in the Drupal LDAP / Active Directory Integration module (versions 0.0.0 through 2.2.1). The module does not sufficiently sanitize user-supplied input before incorporating it into an LDAP search filter, allowing an unauthenticated, remote attacker...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

CVE-2026-81772

Unauthenticated PHP Object Injection in Ninja Forms - Layout & Styles = 3.0.31 versions...

CVE-2026-81286

Unauthenticated SQL Injection in WCFM Marketplace = 3.8.1 versions...

WordPress GeoDirectory plugin <= 2.8.174 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Tawatchai Pinsuwan in WordPress Plugin GeoDirectory versions = 2.8.174...

CVE-2026-41940

CVE-2026-41940 – cPanel/WHM 認証バイパス + ルートパスワード変更ツール このスクリプトは、cPanel/WHM（CVE-2026-41940）の認証バイパス脆弱性を、CRLFインジェクション技術を用いて管理者セッションを偽装することで悪用します。成功すると、スクリプトはWHMでrootユーザーのパスワードを変更し、Telegram経由で通知を送信できます。 警告: 所有している、または書面による許可を得たシステムのセキュリティテストにのみ使用してください。このスクリプトを不正アクセスに悪用することは法律違反となります。 📦 依存関係のインストール（PIP）...

CVE-2022-44830

Suggested description Sourcecodester Event Registration App v1.0 was discovered to contain multiple CSV injection vulnerabilities via the First Name, Contact and Remarks fields. These vulnerabilities allow attackers to execute arbitrary code via a crafted excel file. Additional Information Proof ...

CVE-2023-38646

CVE-2023-38646 Metabase 사전 인증 RCESQL 인젝션 경유를 악용하는 Python 스크립트 이 스크립트는 GET /api/session/properties 요청을 보내 셋업 토큰을 얻고 대상의 악용 가능 여부를 평가합니다. 취약한 경우 셋업 토큰을 출력하고, 그렇지 않으면 오류 메시지를 출력한 후 종료합니다. -x 옵션이 사용되고 대상이 취약한 경우, 제공된 페이로드로 취약점 악용을 시도합니다. 취약점을 발견한 팀의 훌륭한 분석 글에서 더 자세한 정보를 확인할 수 있습니다...

CVE-2019-18890

CVE-2019-18890 CVE-2019-18890 POC Proof of Concept REDMINE UP TO 3.2.9/3.3.9 SQL INJECTION https://nvd.nist.gov/vuln/detail/CVE-2019-18890 Requirements: Access credentials Subproject is required REST API is enabled On Mysql the first query on which injection occurs looks like the example below wi...

CVE-2026-72530-TrueConf-Sandbox-Escape-

CVE-2026-72530: TrueConf Server サンドボックスエスケープ - 緩和策 & 検出 PoC 📌 概要 このリポジトリには、TrueConf Server における重大な脆弱性 CVE-2026-72530 （コードインジェクションおよびサンドボックスエスケープ ）の緩和策と検出方法に関する教育的なデモが含まれています。 脆弱性の背景: この脆弱性により、認証されていないリモート攻撃者が TrueConf の隔離環境から脱出し、ホストシステム上で任意のコードを実行できる可能性があります 影響を受けるバージョン: TrueConf Server 5.3.9 より前...

CVE-2024-0044-EXP

CVE-2024-0044-EXP Exploit CVE-2024-0044 Android privilege escalation to download arbitrary target app sandbox files. Usage root@kitploit: ./CVE-2024-0044.sh Parameters root@kitploit: Path to any local APK file Target app package name Example root@kitploit: ./CVE-2024-0044.sh /path/to/target.apk...

CVE-2025-5287

CVE-2025-5287 Likes and Dislikes Plugin = 1.0.0 - Unauthenticated SQL Injection Description The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied...

CVE-2025-4578

CVE-2025-4578 File Provider = 1.2.3 - 未認証SQLインジェクション 説明 WordPress用File Providerプラグインは、ユーザー指定パラメータのエスケープ処理が不十分で、既存のSQLクエリの準備も不十分なため、'fileId'パラメータを介したSQLインジェクションに対して、1.2.3を含む全バージョンで脆弱です。これにより、未認証の攻撃者が既存のクエリに追加のSQLクエリを注入し、データベースから機密情報を抽出することが可能になります。 詳細 タイプ : プラグイン Slug : file-provider 影響を受けるバージョン :...

CVE-2025-22954

Koha CVE-2025-22954: SQL Injection in lateissues-export.pl Overview This repository contains a proof of concept for CVE-2025-22954, a critical severity CVSS 10.0 SQL injection vulnerability in Koha before version 24.11.02. The vulnerability exists in the GetLateOrMissingIssues function in...

CVE-2024-56059

CVE-2024-56059 Partners = 0.2.0 - Unauthenticated PHP Object Injection Description The Partners plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 0.2.0 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject...

CVE-2025-22777

CVE-2025-22777 GiveWP – Donation Plugin and Fundraising Platform = 3.19.3 - 認証なしPHPオブジェクトインジェクション 説明 WordPress用プラグイン「GiveWP – Donation Plugin and Fundraising...

CVE-2024-52433

CVE-2024-52433 My Geo Posts Free = 1.2 - Unauthenticated PHP Object Injection Description The My Geo Posts Free plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.2 via deserialization of untrusted input. This makes it possible for unauthenticated...

CVE-2024-3605

CVE-2024-3605 WP Hotel Booking = 2.1.0 - Unauthenticated SQL Injection Description The WP Hotel Booking plugin for WordPress is vulnerable to SQL Injection via the 'roomtype' parameter of the /wphb/v1/rooms/search-rooms REST API endpoint in all versions up to, and including, 2.1.0 due to...

CVE-2024-13489

CVE-2024-13489 LTL Freight Quotes – Old Dominion Edition = 4.2.10 - Unauthenticated SQL Injection Description The LTL Freight Quotes – Old Dominion Edition plugin for WordPress is vulnerable to SQL Injection via the 'editid' and 'dropshipeditid' parameters in all versions up to, and including,...