CVE-2026-49098

CVE-2026-49098 — camel-kafka kafka.OVERRIDETOPIC 标头注入 针对同一 Apache Camel 漏洞的可运行概念验证复现程序，每个运行时一个： 运行时| 目录| 技术栈 ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 + camel-spring-boot 4.18.2 Camel Quarkus| camel-quarkus/| Quarkus 3.36.0 + Camel Quarkus 3.36.0（捆绑 Camel 4.20.0 ） 两者均为受...

CVE-2025-6254

CVE-2025-6254 — Doctreat Core = 1.6.8 — 未认证权限提升（通过角色注入） 🔥 漏洞摘要 WordPress 插件 Doctreat Core 版本 = 1.6.8 存在一个未认证权限提升 漏洞。该严重缺陷允许未认证攻击者 直接通过插件的注册 AJAX 端点创建新的管理员 账户。 该漏洞源于 hooks/hooks.php 文件中的 doctreatprocessregistration 函数，该函数直接从用户提交的 POST 数据中接受 usertype 参数，并将其作为 role 参数传递给...

CVE-2024-51482

CVE-2024-51482 — ZoneMinder 基于时间的盲 SQL 注入 针对 CVE-2024-51482 的概念验证利用脚本，该漏洞是 ZoneMinder v1.37. ≤ 1.37.64 中经过身份验证的基于时间的盲 SQL 注入漏洞。 该脚本利用基于 SLEEP 的二分搜索（bisection）手段，从 zm.Users 表中提取用户名和密码哈希值。 漏洞详情 web/ajax/event.php 中的 removetag 处理器安全地参数化了 DELETE 查询，但随后直接将用户可控的输入插入了后续的 SELECT 查询： root@kitploit: // Saf...

cve-2025-58360

GeoServer: CVE-2025-58360 免责声明 本仓库中的代码和信息仅用于教育和研究目的。仓库所有者对您使用本仓库中的代码和/或信息所做的任何事情不承担任何责任。您的行为由您自己负责。请合法且负责任地使用。 Python3 类 exploit/exploiter.py 文件中的 Python3 类（GeoDumper）自动化利用了 XXE 漏洞，并将泄露的信息保存到本地文件中。 示例： root@kitploit: import exploit.exploiter as exploiter targetip = "localhost" secure = False...

cve-2026-0770-langflow_rce_reproduction

CVE-2026-0770：Langflow execglobals 远程代码执行 CVSS 9.8（严重） | ZDI-CAN-27325 | CWE-829：包含来自不受信任的控制领域的功能 概述 CVE-2026-0770 是 Langflow 中的一个严重未认证远程代码执行漏洞，Langflow 是一个用于构建 LLM 驱动应用的低代码应用框架。该缺陷位于 /api/v1/validate 端点，其中 execglobals 参数被不安全地传递给 Python 的 exec 函数，允许未认证的攻击者以 Langflow 进程的权限（通常为 root）执行任意代码。...

CVE-2026-49099

CVE-2026-49099 — camel-salesforce sObjectQuery 请求头注入 同一 Apache Camel 漏洞的可运行概念验证（PoC）复现程序，每种运行时各一个： 运行时| 目录| 技术栈 ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 + camel-spring-boot 4.18.2 Camel Quarkus| camel-quarkus/| Quarkus 3.36.0 + Camel Quarkus 3.36.0（捆绑 Camel 4.20.0 ）...

maya

maya Anti-manipulación y anti-explotación para ELF en Linux. Prototipo de 2014. Ya no recibe mantenimiento. Binarios objetivo: solo binarios ELF de tipo ETEXEC. Maya utiliza un motor de ejecución reubicable, 'tracer.o', que finalmente se inyecta y enlaza en el binario protegido. Este es el núcleo...

CVE-2026-48206

CVE-2026-48206 — camel-jira IssueKey 标头注入 针对同一 Apache Camel 漏洞的可运行概念验证（PoC）复现程序，每种运行时一个： 运行时| 目录| 技术栈 ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 + camel-spring-boot 4.18.2 Camel Quarkus| camel-quarkus/| Quarkus 3.36.0 + Camel Quarkus 3.36.0（捆绑 Camel 4.20.0 ） 两者均为受影响 版本（已...

CVE-2026-86161

A vulnerability was found in SourceCodester Online Voting System 1.0. The impacted element is an unknown function of the file /ajax.php?action=deletecategory. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit has been...

CVE-2026-86162

A vulnerability was determined in SourceCodester Online Voting System 1.0. This affects an unknown function of the file /ajax.php?action=login. Executing a manipulation of the argument Username can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed...

CVE-2026-86159

A flaw has been found in SourceCodester Online Voting System 1.0. Impacted is an unknown function of the file /ajax.php?action=saveuser. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used...

CVE-2026-86160

A vulnerability has been found in SourceCodester Online Voting System 1.0. The affected element is an unknown function of the file /ajax.php?action=deletevoting. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the...

CVE-2026-86164

itsourcecode Sales and Inventory System 1.0 contains a SQL injection vulnerability in the file /pages/trans_view.php, triggered by manipulation of the ID argument. The attack can be performed remotely with low privileges required and no user interaction (CVSS 3.1: 6.3 MEDIUM ). The exploit has be...

EUVD-2026-72048

A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/transview.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit has been released to the public...

CVE-2026-86164 itsourcecode Sales and Inventory System trans_view.php sql injection

A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/transview.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit has been released to the public...

CVE-2026-86163 itsourcecode Sales and Inventory System pro_del.php sql injection

A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This impacts an unknown function of the file /pages/prodel.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly available and might...

EUVD-2026-72047

A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This impacts an unknown function of the file /pages/prodel.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly available and might...

CVE-2026-86163

itsourcecode Sales and Inventory System 1.0 contains a SQL injection vulnerability in the file /pages/pro_del.php , triggered by manipulation of the ID argument. The attack is exploitable remotely and requires low privileges with no user interaction. The base CVSS 3.1 score is 6.3 (MEDIUM) with l...

GHSA-RGWJ-5XJ2-C3M3 vulnerabilities

Vulnerabilities for packages: sqlpad...

CVE-2025-22964

CVE-2025-22964: DDSN Interactive cm3 Acora CMS 10.1.1 版本中的基于时间的盲 SQL 注入漏洞 DDSN Interactive cm3 Acora CMS 10.1.1 版本存在一个基于时间的盲 SQL 注入漏洞，该漏洞由 "table" 参数中输入消毒和验证不足引起。此缺陷允许攻击者通过直接将用户提供的输入纳入数据库查询而缺乏适当的转义或验证，从而注入恶意 SQL 查询。利用此问题可实现未经授权的访问、数据操纵或敏感信息泄露，对应用程序的完整性和机密性构成重大风险。 受影响版本: Acora CMS v10.1.1 发现者: Cro...