CVE-2026-22599

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-22599 CVE-2026-22599 Strapi 5.33.1 - Strapi 我是 @abraxasnull。Loopback 实验环境。客户端为 CVE-2026-22599-Abraxas-Labs.py。 Content-Type Builder 写入 API 数据库查询注入。Yup 会进行校验，但不会剥离未知的 column.defaultTo。Schema builder 将 value,...

JS Help Desk <= 2.8.2 - SQL Injection

JS Help Desk WordPress plugin 2.8.2 contains a SQL injection caused by insufficient escaping and preparation of user-supplied values in 'js-support-ticket-token-tkstatus' cookie, letting unauthenticated attackers extract sensitive database information, exploit requires no authentication. id:...

Code-Projects School Fees Payment System 1.0 - SQL Injection

A vulnerability was found in code-projects School Fees Payment System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /student.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been...

ChurchCRM - SQL Injection

A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a time-based blind SQL Injection vulnerability in the EditEventTypes functionality. The newCountName parameter is directly concatenated into an SQL query without proper...

CVE-2026-103255 n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal and Query Injection via Supabase

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the Supabase node where the tableId parameter is inserted into request paths without validation. Attackers can exploit workflows binding tableId to untrusted input to...

CVE-2026-103255 n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal and Query Injection via Supabase

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the Supabase node where the tableId parameter is inserted into request paths without validation. Attackers can exploit workflows binding tableId to untrusted input to...

CVE-2026-103255

Versions of n8n prior to 1.123.80, and from 2.0.0 before 2.39.6 and from 2.40.0 before 2.40.1, are vulnerable to a path traversal and query injection flaw in the Supabase node . The root cause is the lack of validation when the tableId parameter is inserted into request paths. Attackers can explo...

CVE-2026-56096

CVE-2026-56096: Solr Query Injection & Blind Data Extraction in TYPO3 EXT:solr An architectural security vulnerability was discovered in the official TYPO3 Apache Solr extension EXT:solr / apache-solr-for-typo3/solr. The issue allows unauthenticated remote attackers to inject arbitrary Solr/Lucen...

CVE-2024-3408-dtale

CVE-2024-3408 - D-Tale 認証バイパス & RCE CVE-2024-3408 の再現可能なラボ環境です。D-Tale における認証バイパスおよびリモートコード実行の脆弱性です。 脆弱性 D-Tale バージョン 3.15.1 以前は、以下の理由により脆弱です： 1. ハードコードされた SECRETKEY "Dtale" による Flask セッション署名 - セッションクッキーの偽造が可能 2. カスタムフィルターによるコード実行 - test-filter エンドポイントは pandas クエリを使用しており、任意の Python...

CVE-2026-81914

Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. A name containing an apostrophe therefore terminated the literal early and appended...

CVE-2026-81914 Apache Airflow Google provider: Google Drive query injection via unescaped file and folder names

Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. A name containing an apostrophe therefore terminated the literal early and appended...

CVE-2026-81914 Apache Airflow Google provider: Google Drive query injection via unescaped file and folder names

Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. A name containing an apostrophe therefore terminated the literal early and appended...

CVE-2026-81914

The Apache Airflow Google provider is vulnerable to Google Drive query injection because it interpolates file and folder names directly into single-quoted string literals without escaping quote characters. An attacker can use an apostrophe in a filename to terminate the literal and append malicio...

EUVD-2026-88694

Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. A name containing an apostrophe therefore terminated the literal early and appended...

CVE-2026-74251

Phoca Cart 中通过属性过滤器的未认证 SQL 注入 Phoca Cart ≤ 6.1.6——未认证攻击者通过时间盲注提取完整数据库 摘要 Phoca Cart 公共商店物品页面上的 a（属性）和 s（规格）GET 数组参数未经参数化或转义，被原样拼接进 SQL WHERE 子句。未认证攻击者可通过这些参数注入任意 SQL，从而利用时间盲注技术提取完整数据库。 该漏洞存在于 admin/libraries/phocacart/search/search.php 中的 getSqlPartsArray 函数。该函数在构建 IN 列表之前调用 explode',',...

CVE-2022-0739

CVE-2022-0739 Python PoC エクスプロイト for CVE-2022-0739 機能 データベースメタデータの検索 Wordpress ユーザー資格情報のダンプ 任意のブラインドクエリインジェクション 💉 使用方法 usage: cve-2022-0739 -h -u URL -e EXEC options: -h, --help show this help message and exit -u URL, --url URL URL of the page containing the BookingPress Widget -e EXEC, --exec EX...

CVE-2026-90979: Improper Neutralization of Special Elements used in an LDAP Query

LDAPCache and LDAPBackingEngine build LDAP search filters for user lookup and role lookup by textually substituting the placeholders %u, %dn, and %fqdn drawn from the login name, the resolved user DN, and its fully qualified namespace form into administrator-configured filter templates...

CVE-2026-100631

Parse Server is an open source backend server. In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1-alpha.9, the device token deduplication logic for installation records does not validate the type of client-supplied installation fields before using them to build database querie...

CVE-2026-100631

The open-source backend server Parse Server is vulnerable to an unauthenticated remote attack in versions prior to 8.6.90 and from 9.0.0 prior to 9.10.1-alpha.9 . The root cause is a failure to validate the type of client-supplied installation fields within the device token deduplication logic be...

EUVD-2026-87725

Parse Server is an open source backend server. In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1-alpha.9, the device token deduplication logic for installation records does not validate the type of client-supplied installation fields before using them to build database querie...