The vulnerability of the Webasyst content management system and the Shop-Script CMS system lies in the lack of measures to protect the SQL query structure, allowing attackers to execute arbitrary SQL code.

The vulnerability of the Webasyst framework for designing content management systems and the Shop-Script CMS system lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary SQL code...

CVE-2022-34265

CVE-2022-34265 使用方法 起動 docker-compose build docker-compose up -d 停止 docker-compose down Django の脆弱性 CVE-2022-34265 の PoC 検証 Django の脆弱性 CVE-2022-34265 が 2022年7月5日（米国時間）に公開されました。この記事では、本脆弱性に関する議論と検証結果について説明します。 脆弱性概要 本脆弱性は、Django で日付データに使用される関数 Trunc および Extract の引数に対して SQL...

MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)

SummaryIn SSE/HTTP transport mode, mysqlmcpserver constructs SseServerTransport without passing securitysettings. As a result, the MCP Python SDK's DNS-rebinding protection Origin/Host header validation is disabled; the Starlette application has no CORS or TrustedHost middleware; and the service...

CVE-2026-34220

CVE-2026-43220 MikroORM SQL 注入 ★ CVE-2026-43220 MikroORM SQL 注入 PoC ★ https://github.com/user-attachments/assets/33724cfc-6151-47ff-9415-2f50c5124cd1 概述 CVE-2026-43220 是 MikroORM 中的一个 SQL 注入 漏洞，MikroORM 是一个广泛使用的 TypeScript/Node.js ORM 框架。 当包含 raw 属性的用户提供值在未经校验的情况下被传入 自定义类型列 时，MikroORM 的 isRaw...

CVE-2026-103244 ground-station before 0.8.0 Authentication Bypass via setup.restore

ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated attackers to execute arbitrary SQL during first-run setup mode. Attackers can invoke setup.restore via Socket.IO to plant admin users and forged session...

CVE-2026-103244 ground-station before 0.8.0 Authentication Bypass via setup.restore

ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated attackers to execute arbitrary SQL during first-run setup mode. Attackers can invoke setup.restore via Socket.IO to plant admin users and forged session...

CVE-2025-67644-LangGraph-3.0.1-SQLite-Checkpoint-SQL-Injection

CVE-2025-67644 PoC – LangGraph SQLite 检查点 SQL 注入 CVE-2025-67644 是 langgraph-checkpoint-sqlite 包（属于 LangGraph / LangChain 生态）中的一个 SQL 注入 漏洞（CWE-89）。 攻击者可通过传递给 SqliteSaver 的 list / alist 方法的未经净化的元数据过滤键 注入任意 SQL。 影响 ：可完全绕过过滤器、泄漏所有检查点记录（包括可能敏感的对话状态、线程 ID、元数据），在某些部署场景下还可实现更广泛的数据库访问。 受影响版本 ：|"Sends...

sparx_hack

Sparx Pro Cloud Server および Enterprise Architect における複数の脆弱性 認証なしで Sparx PCS サーバー上で任意の SQL コマンドを実行するためのエクスプロイトコード。 注意: キーは 正しくありません 。これは s|rIpt kIddi3 による簡単なハッキングを防ぐためのものです ;- 完全な解説: https://sploit.tech/2026/05/19/Sparx-Enterprise-Architect-PCS.html クレジット: br0x https://sploit.tech/ チーム: Efigo...

CVE-2025-59213

Microsoft Configuration Manager ConfigMgr / SCCM 2503 未认证 SQL 注入 CVE-2025-59213 漏洞利用 此脚本利用 CVE-2025-59213 漏洞，该漏洞允许具有网络访问权限的未认证攻击者通过滥用 Discovery Data Manager DDM 的 DuplicateAMTMachineRecord 方法中的 SQL 注入缺陷，在站点数据库上执行任意 SQL 查询。在合并两个硬件 ID 冲突的客户端时，未转义的 HardwareID0 字段被不当处理。 当缺少 KB34503790 时，以下所有 Microsof...

sccm_sql_backdoor

sccmsqlbackdoor 一个概念验证工具，用于将受控后门植入管理点（Management Point）存储过程，从而通过合法的 MP HTTP 服务实现间接 SQL 执行。 安装 你可以通过克隆仓库并安装依赖项来安装。 $ git clone --recurse-submodules https://github.com/synacktiv/sccmsqlbackdoor $ cd sccmsqlbackdoor $ python3 -m venv .venv && source .venv/bin/activate $ pip install -e . 用法 $ python3...

CVE-2024-50972

CVE-2024-50972 説明 Itsourcecode Construction Management System 1.0 の printtool.php における SQL インジェクションの脆弱性により、リモート攻撃者が borrowid パラメータを介して任意の SQL コマンドを実行可能です。 脆弱性タイプ SQLインジェクション 製品ベンダー Itsourcecode 影響を受ける製品コードベース:...

CVE-2024-50971

CVE-2024-50971 説明 Itsourcecode Construction Management System 1.0 の print.php における SQL インジェクションの脆弱性により、リモート攻撃者が mapid パラメータを介して任意の SQL コマンドを実行できる可能性があります。 脆弱性タイプ SQL インジェクション 製品ベンダー Itsourcecode 影響を受ける製品コードベース:...

CVE-2026-100683

Budibase (@budibase/server ) versions before 3.45.0 are vulnerable to SQL injection due to improper handling of column-rename DDL in packages/backend-core/src/sql/sqlTable.ts. The application interpolates identifiers directly into raw query strings for MySQL and MSSQL without using proper identif...

DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution

Summary DBHub 0.21.2 exposes an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport mode, for example --transport http --port 8080. The HTTP server attempts to protect browser-origin access by checking whether the Origin hostname equals the Host hostname, then...

GHSA-FM8P-53WW-HF6W DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution

Summary DBHub 0.21.2 exposes an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport mode, for example --transport http --port 8080. The HTTP server attempts to protect browser-origin access by checking whether the Origin hostname equals the Host hostname, then...

CVE-2026-61742 DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution

DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Versions prior to 0.22.5 expose an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport mode, for example --transport http --port 8080. The HTTP server attempts to protect...

CVE-2026-61742 DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution

DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Versions prior to 0.22.5 expose an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport mode, for example --transport http --port 8080. The HTTP server attempts to protect...

CVE-2026-61742

The DBHub database MCP server (versions prior to 0.22.5 ) is vulnerable to a DNS rebinding attack when using the HTTP transport mode (e.g., --transport http --port 8080). The server fails to properly validate browser-origin access because it reflects the Origin hostname into the Access-Control-Al...

CVE-2026-61852

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery implementation in server/modules/ai/orchestrator/tools/runQuery.js interpolates the AI tool's rowlimit parameter into a SQL LIMIT...

CVE-2026-65980 Chartbrew: SQL Injection via Missing Backslash Escaping in ClickHouse Variable Substitution

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, Chartbrew's ClickHouse protocol in server/sources/plugins/clickhouse/clickhouse.protocol.js calls applySqlVariables from...