265361 matches found
CVE-2026-110265 runZero search SQL injection
A specially crafted malformed search query could return results from outside a user's organization. Log analysis of runZero's hosted environment found only testing of the issue and no adversary traffic. This issue was fixed in version 5.1.261013.1...
CVE-2026-120065
For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to identify rows. It places the column's name, as reported by the server, between double quotes in its keyset queries and in the WHERE clause of its positioned SELECT, UPDATE, and...
CVE-2026-120062
SQLSpecialColumns in psqlODBC splices the table and schema names it receives into its catalog query without escaping them, while the other catalog functions escape them. An application that passes an untrusted table or schema name to SQLSpecialColumns lets the caller execute arbitrary SQL with th...
CVE-2026-120059
For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC places that column's name, as reported by the server, into a printf-style format string. It later expands that string with one argument while it builds the WHERE clause of its positioned SELECT,...
breaking-python-lab
Breaking Python Lab Read this in other languages: Español...
Cybersecurity-CTF-Labs-Collection-Web-Application-Security-Exploit-Analysis
Cybersecurity-CTF-Labs-Collection-Web-Application-Security-Exp...
CVE-2026-120558
The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the trackingprovider parameter of the POST /wp-json/wc-ast/v3/orders//shipment-trackings REST endpoint in all versions up to, and including, 3.9. This is due to insufficient escaping on the...
CVE-2026-120563
The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 5.5.7. This is due to insufficient input validation on the currency exchange rate parameter in the savecurrency AJAX handler, which lacks capability...
CVE-2026-120563 WPML Multilingual & Multicurrency for WooCommerce <= 5.5.7 - Authenticated (Shop Manager+) SQL Injection via Exchange Rate Field
The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 5.5.7. This is due to insufficient input validation on the currency exchange rate parameter in the savecurrency AJAX handler, which lacks capability...
WordPress WPML Multilingual & Multicurrency for WooCommerce plugin <= 5.5.7 - Authenticated (Shop Manager+) SQL Injection vulnerability
Authenticated Shop Manager+ SQL Injection vulnerability discovered by Muni Nitish Kumar Yaddala Stranger825 in WordPress Plugin WooCommerce Multilingual & Multicurrency versions = 5.5.7...
CVE-2026-120563
The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to SQL Injection in versions up to and including 5.5.7 . The root cause is insufficient input validation on the currency exchange rate parameter within the save_currency() AJAX handler, which lacks proper ca...
EUVD-2026-115667
The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 5.5.7. This is due to insufficient input validation on the currency exchange rate parameter in the savecurrency AJAX handler, which lacks capability...
CVE-2026-120558
The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 3.9 . The flaw exists in the WC_Advanced_Shipment_Tracking_Admin::get_provider_slug_from_name() method due to insufficient escaping and improper use of $wpdb->...
CVE-2026-120558 Advanced Shipment Tracking for WooCommerce <= 3.9 - Authenticated (Shop Manager+) SQL Injection via 'tracking_provider' Parameter
The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the trackingprovider parameter of the POST /wp-json/wc-ast/v3/orders//shipment-trackings REST endpoint in all versions up to, and including, 3.9. This is due to insufficient escaping on the...
EUVD-2026-115663
The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the trackingprovider parameter of the POST /wp-json/wc-ast/v3/orders//shipment-trackings REST endpoint in all versions up to, and including, 3.9. This is due to insufficient escaping on the...
CVE-2026-95748: Hewlett Packard Enterprise (HPE) Fabric Composer: A SQL injection vulnerability exists in HPE Networking Fabric Composer
A SQL injection vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to run arbitrary database commands...
CVE-2026-121502: mathurvishal CloudClassroom-PHP-Project: A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project
A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project. The impacted element is an unknown function of the file facultydetails.php. The manipulation of the argument deleteid leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and migh...
CVE-2026-109594: SonicWall Global Management System (GMS): Post-authentication Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability…
Post-authentication Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability has been identified in the End-of-Life SonicWall GMS 9.5.2 and earlier versions which in specific conditions could potentially allow an authenticated attacker to access or modify...
HPESBNW05172 rev.1 - Multiple Vulnerabilities in HPE Networking Fabric Composer
Potential Security Impact: Local: Access Restriction Bypass, Denial of Service DoS, Disclosure of Information, Elevation of Privilege, Unauthenticated Disclosure of Information, Unauthorized Read Access to Files, Unauthorized Write Access to the File System; Remote: Arbitrary Command Execution,...
VulnCheck KEV: CVE-2015-7857
SQL injection vulnerability in the getListQuery function in administrator/components/comcontenthistory/models/history.php in Joomla! 3.2 before 3.4.5 allows remote attackers to execute arbitrary SQL commands via the listselect parameter to index.php...