CVE-2025-8536

A SQL injection vulnerability has been identified in DobryCMS. Improper neutralization of input provided by user into language functionality allows for SQL Injection attacks. This issue affects older branches of this software...

CVE-2025-9322 Stripe Payment Forms <= 8.3.1 - Unauthenticated SQL Injection

The Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions plugin for WordPress is vulnerable to SQL Injection via the 'wpfs-form-name' parameter in all versions up to, and including, 8.3.1 due to insufficient escaping on the user supplied parameter and lack ...

CVE-2025-8536

A SQL injection vulnerability has been identified in DobryCMS. Improper neutralization of input provided by user into language functionality allows for SQL Injection attacks. This issue affects older branches of this software...

CVE-2025-8536

DobryCMS is affected by CVE-2025-8536, a SQL injection arising from improper neutralization of user input in the system’s language functionality. The vulnerability impacts older branches of DobryCMS and is rated high impact (CVSS 4.0: Critical overall, with high impact to confidentiality and inte...

CVE-2025-8536 SQL Injection in DobryCMS

A SQL injection vulnerability has been identified in DobryCMS. Improper neutralization of input provided by user into language functionality allows for SQL Injection attacks. This issue affects older branches of this software...

CVE-2025-8536 SQL Injection in DobryCMS

A SQL injection vulnerability has been identified in DobryCMS. Improper neutralization of input provided by user into language functionality allows for SQL Injection attacks. This issue affects older branches of this software...

EUVD-2025-35848

A SQL injection vulnerability has been identified in DobryCMS. Improper neutralization of input provided by user into language functionality allows for SQL Injection attacks. This issue affects older branches of this software...

Expression Language Injection

Spring Cloud Gateway Server Webflux is vulnerable to Expression Language Injection. The vulnerability is due to unsafe SpEL evaluation in routes due to the actuator gateway endpoint being exposed and accessible to untrusted users; attackers can create routes that use SpEL to read environment...

Regular Expression Denial Of Service (ReDoS)

transformers is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to inefficient regular expression processing in the removelanguagecode method of the MarianTokenizer, which allows an attacker to exploit crafted input strings with malformed language code patterns ...

Exploit for Expression Language Injection in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

Penetration Testing & Vulnerability Research Cheatsheet 🛡️ !...

Actionable Cybersecurity Notifications for Smart Homes: A User Study on the Role of Length and Complexity

The proliferation of smart home devices has increased convenience but also introduced cybersecurity risks for everyday users, as many devices lack robust security features. Intrusion Detection Systems are a prominent approach to detecting cybersecurity threats. However, their alerts often use...

Studio Fabryka DobryCMS SQL注入漏洞

Studio Fabryka DobryCMS is a content management system from Studio Fabryka, Inc. Studio Fabryka DobryCMS suffers from a SQL injection vulnerability that stems from improper neutralization of user-entered language functions, which could lead to an SQL injection attack...

PT-2025-43629

Name of the Vulnerable Software and Affected Versions DobryCMS affected versions not specified Description A SQL injection issue exists in DobryCMS due to insufficient input validation within the language functionality. This allows for potential SQL Injection attacks. The issue impacts older...

The vulnerability of the MongoDB Atlas SQL ODBC Driver’s driver allows attackers to escalate their privileges.

The vulnerability of the MongoDB Atlas SQL ODBC Driver lies in the improper use of standard permissions. Exploiting this vulnerability allows a malicious actor to enhance their privileges remotely...

CVE-2025-8536: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability has been identified in DobryCMS. Improper neutralization of input provided by user into language functionality allows for SQL Injection attacks. This issue affects older branches of this software...

Oracle MySQL Server 8.4.x < 8.4.7 (October 2025 CPU)

The versions of MySQL Server installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2025 CPU advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and...

CVE-2025-62617

Admidio is an open-source user management solution. Prior to version 4.3.17, an authenticated SQL injection vulnerability exists in the member assignment data retrieval functionality of Admidio. Any authenticated user with permissions to assign members to a role such as an administrator can explo...

CVE-2025-8848

A vulnerability in danny-avila/librechat version 0.7.9 allows for HTML injection via the Accept-Language header. When a logged-in user sends an HTTP GET request with a crafted Accept-Language header, arbitrary HTML can be injected into the tag of the response. This can lead to potential security...

Privilege Escalation

intelliants/subrion is vulnerable to privilege escalation. The vulnerability is due to improper access control in the built-in “Run SQL Query” feature under the SQL Tool admin panel, which allows authenticated administrators or moderators to execute arbitrary SQL commands and gain escalated...

REx86: A Local Large Language Model for Assisting in X86 Assembly Reverse Engineering

Reverse engineering RE of x86 binaries is indispensable for malware and firmware analysis, but remains slow due to stripped metadata and adversarial obfuscation. Large Language Models LLMs offer potential for improving RE efficiency through automated comprehension and commenting, but cloud-hosted...