ko7demo

Docker化した https://github.com/koseven/kosevenkoseven のハローワールドアプリケーションで、3.3.10未満のバージョンに影響するSQLインジェクション脆弱性 CVE-2019-8979 を試すためのものです。 このハローワールドは実際には https://koseven.dev/documentation/orm/examples/simpleドキュメント から持ってきたもので、Docker部分とPoCエクスプロイトを追加しただけです。 = CVE-2019-8979 このSQLインジェクション問題は、元々第三者によって...

goodoldsearch-oss

Good Old Search 정확한 구문, 사이트 필터, 제외어, 날짜 범위, 파일 유형을 사용하여 정밀한 검색 쿼리를 작성하고, 검색 엔진 및 수직 검색 대상에 대한 원클릭 링크를 제공합니다. 이것은 검색 엔진, 메타검색 수집기, 스크레이퍼 또는 API 프록시가 아닙니다. 선택한 검색 엔진을 여는 로컬 정적 쿼리 빌더입니다. 앱은 다섯 가지 화면으로 구성되어 있습니다: Simple : index.html의 일상적인 정확 검색 빌더. Advanced Search Lab : advanced.html의 전문 연산자 빌더로,...

oopso

oopso 検索エンジン全体で公開されたファイルマネージャーを発見するための、使いやすいクライアントサイド型OSINTクエリビルダーです。 バージョン: 1.0 特徴 マルチエンジン対応: フィンガープリントを自動的に Shodan、FOFA、ZoomEye、Censys のネイティブクエリ構文に変換します 幅広いカバレッジ: 24種類のWebファイルマネージャー（Tiny File Manager、elFinder、phpMyAdmin など）用の組み込みシグネチャを搭載 デュアルターゲットモード:...

CVE-2026-101144

A vulnerability was determined in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/searchAction.do of the component Query Builder. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The exploit has been publicly...

CVE-2026-101144

A vulnerability exists in Eleveo Call Recording Software 9.7.0 within the Query Builder component. Specifically, an unknown part of the /callrec/searchAction.do file is susceptible to manipulation, resulting in improper access controls . This flaw allows for remote exploitation , and the exploit ...

EUVD-2026-88475

A vulnerability was determined in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/searchAction.do of the component Query Builder. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The exploit has been publicly...

CVE-2026-101144 Eleveo Call Recording Software Query Builder searchAction.do access control

A vulnerability was determined in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/searchAction.do of the component Query Builder. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The exploit has been publicly...

CVE-2026-101144 Eleveo Call Recording Software Query Builder searchAction.do access control

A vulnerability was determined in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/searchAction.do of the component Query Builder. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The exploit has been publicly...

EUVD-2026-88051

A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System up to 81bf0b55f5933f3b0dbb1583204a612e06605b95. The impacted element is the function orderby of the file DBquerybuilder.php of the component Database Query Builder. Performing a manipulation of the argumen...

CVE-2026-100887

A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System up to 81bf0b55f5933f3b0dbb1583204a612e06605b95. The impacted element is the function orderby of the file DBquerybuilder.php of the component Database Query Builder. Performing a manipulation of the argumen...

CVE-2026-101144: Improper Access Control

A vulnerability was determined in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/searchAction.do of the component Query Builder. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The exploit has been publicly...

CVE-2026-100887: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System up to 81bf0b55f5933f3b0dbb1583204a612e06605b95. The impacted element is the function orderby of the file DBquerybuilder.php of the component Database Query Builder. Performing a manipulation of the argumen...

PT-2026-102344

Name of the Vulnerable Software and Affected Versions Eleveo Call Recording Software version 9.7.0 Description Improper access controls exist within the Query Builder component, specifically affecting the '/callrec/searchAction.do' endpoint. This flaw allows for remote exploitation. Recommendatio...

CVE-2026-100887 amirsanni Mini-Inventory-and-Sales-Management-System Database Query Builder DB_query_builder.php order_by sql injection

A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System up to 81bf0b55f5933f3b0dbb1583204a612e06605b95. The impacted element is the function orderby of the file DBquerybuilder.php of the component Database Query Builder. Performing a manipulation of the argumen...

CVE-2026-100887 amirsanni Mini-Inventory-and-Sales-Management-System Database Query Builder DB_query_builder.php order_by sql injection

A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System up to 81bf0b55f5933f3b0dbb1583204a612e06605b95. The impacted element is the function orderby of the file DBquerybuilder.php of the component Database Query Builder. Performing a manipulation of the argumen...

CVE-2026-100887

A SQL injection vulnerability exists in the Database Query Builder component of the amirsanni Mini-Inventory-and-Sales-Management-System (versions up to 81bf0b55f5933f3b0dbb1583204a612e06605b95 ). The flaw is located in the order_by function within the DB_query_builder.php file, where manipulatio...

PT-2026-99728

Name of the Vulnerable Software and Affected Versions amirsanni Mini-Inventory-and-Sales-Management-System versions up to 81bf0b55f5933f3b0dbb1583204a612e06605b95 Description A security flaw in the Database Query Builder component allows remote exploitation via SQL injection. The issue occurs whe...

GHSA-JG26-Q8HG-3PQ4 Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated)

Impact An unauthenticated JCR-SQL2 injection exists in the Smart Content category filter of the 2.x content query builder. Category IDs supplied through the public ?categories= query parameter are only trimmed and are then concatenated directly into a JCR-SQL2 WHERE clause, without the numeric...

Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated)

Impact An unauthenticated JCR-SQL2 injection exists in the Smart Content category filter of the 2.x content query builder. Category IDs supplied through the public ?categories= query parameter are only trimmed and are then concatenated directly into a JCR-SQL2 WHERE clause, without the numeric...

CVE-2026-93759

Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argument may cause code of their choosing...