dvna

Damn Vulnerable NodeJS Application DVNA Damn Vulnerable NodeJS Application DVNA is a simple NodeJS application to demonstrate OWASP Top 10 Vulnerabilities and guide on fixing and avoiding these vulnerabilities. The fixes branch will contain fixes for the vulnerabilities. Fixes for vulnerabilities...

PhoneMonitor

PhoneMonitor Una herramienta de administración remota para dispositivos Android. La versión mínima de SDK para la aplicación es API 15 y, por su naturaleza, el nivel de API objetivo tiene sentido que sea 21. Instrucciones: Abre la carpeta PhoneMonitor con Android Studio. Reemplaza las cadenas XXX...

CVE-2026-75133

Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulnerability that allows unauthenticated attackers to trigger a full MySQL database dump by accessing the publicly exposed kbdcronprocess parameter without authentication. Attackers can predict the...

EUVD-2026-68608

Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulnerability that allows unauthenticated attackers to trigger a full MySQL database dump by accessing the publicly exposed kbdcronprocess parameter without authentication. Attackers can predict the...

CVE-2026-75133 Keep Backup Daily WordPress Plugin < 2.1.4 Sensitive Information Exposure via kbd_cron_process

Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulnerability that allows unauthenticated attackers to trigger a full MySQL database dump by accessing the publicly exposed kbdcronprocess parameter without authentication. Attackers can predict the...

PoC-CVE-2025-66224

OrangeHRM RCE Exploit - CVE-2025-66224 📋 Beschreibung Dieses Proof of Concept PoC demonstriert eine Remote Code Execution RCE-Schwachstelle in OrangeHRM durch Befehlseinschleusung im Konfigurationsparameter sendmailpath. Der Exploit funktioniert wie folgt: 1. Injizieren einer schädlichen Nutzlast...

EUVD-2026-39020

Ghost Content API filter bypass reveals private fields...

Photon OS 5.0: Mysql PHSA-2023-5.0-91-0056

An update of the mysql package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-5.0-91-0056. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

EUVD-2021-34856

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. It uses a hardcoded symmetric encryption key to encrypt secrets in the MySQL databases. This key is not unique for each installation. An attacker that gains access to the MySQL server or a backup files can decrypt th...

CVE-2021-32086

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. It uses a hardcoded symmetric encryption key to encrypt secrets in the MySQL databases. This key is not unique for each installation. An attacker that gains access to the MySQL server or a backup files can decrypt th...

GHSA-CMWH-G2H8-C222 Poweradmin: OIDC `sub` collation bypass in Poweradmin leading to account takeover

Preface Poweradmin maps OIDC identities into local users through oidcuserlinks.oidcsubject plus providerid. In the MySQL schema, the OIDC link table explicitly uses utf8mb4unicodeci, which is case-insensitive and accent-insensitive. OIDC sub is a stable external subject identifier and should be...

CVE-2026-55170 OpenFGA MySQL backend: case-insensitive collation on identifier columns causes incorrect authorization decisions

OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, when MySQL is being used as the datastore and authorization decisions rely on case-sensitive user strings, the tuple, changelog, and authorizationmodel identifier columns can compare case-distinct values such as...

PYSEC-2026-1931 social-auth-app-django affected by Improper Handling of Case Sensitivity

Impact Due to default case-insensitive collation in MySQL or MariaDB databases, third-party authentication user IDs are not case-sensitive and could cause different IDs to match. Patches This issue has been addressed by https://github.com/python-social-auth/social-app-django/pull/566 and fix...

CVE-2026-53949

Summary (CVE-2026-53949) Ghost CMS (Node.js). Affected versions: 5.46.1–6.21.2. Description: validation on filters for public API endpoints could be partially bypassed, enabling disclosure of private fields via brute-force. Impact depends on database: with SQLite, password hashes were fully acces...

SQL Injection

Overview mysql-mcp-server is an A Model Context Protocol MCP server that enables secure interaction with MySQL databases. This server allows AI assistants to list tables, read data, and execute SQL queries through a controlled interface, making database exploration and analysis safer and more...

jflyfox jfinal_cms 注入漏洞

jfinalcms is a content management system used for managing website sections, articles, and feedback content. jflyfox jfinalcms has a SQL injection vulnerability. The vulnerability arises due to the list function in the AdvicefeedbackController.java file not properly filtering the orderBy paramete...

CVE-2026-48188

An improper Input Validation vulnerability in OTRS or OTRS Community Edition database layer module allows an unauthenticated SQL injection which can lead to an authentication bypass. This issue only affects the system if the MySQL/MariaDB server is configured with the NOBACKSLASHESCAPES SQL mode...

CVE-2025-41280

Nozomi Networks Labs identified a CWE-23: Relative Path Traversal Zip Slip in Waterfall WF-500 RX Host in version 7.9.1.0 R2502171040 that allows attackers with access to the TX Host to execute code on the RX Host when a MySQL connector is configured and file compression is enabled...

mysql: InnoDB unspecified vulnerability (CPU Apr 2026)

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access via...

CVE-2018-25372

MedDream PACS Server Premium 6.7.1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the email parameter. Attackers can submit crafted POST requests to the userSignup.php endpoint with SQL payloads ...