PT-2026-79578

Name of the Vulnerable Software and Affected Versions Fabrik versions prior to 4.7.3 Description An unauthenticated SQL injection exists in the list models where the order parameter is used in queries without proper validation. This allows attackers to use read SQLi vectors to extract information...

lab-cve-2025-57819

Lavori in corso FreePBX CVE-2025-57819 Lab - SQLi non autenticata → Catena RCE Nuclei POC Avvia un laboratorio FreePBX 15 riproducibile Docker per validare CVE-2025-57819 — una critica SQL injection non autenticata negli endpoint AJAX di userman che può essere concatenata per ottenere RCE. Includ...

Metabase-Setup-Endpoint-SQLi-Fix

CVE-2026-72898: SQLi-Patch für den Metabase-Setup-Endpunkt Dieses Repository enthält den Hotfix für CVE-2026-72898 , eine nicht authentifizierte SQL-Injection-Schwachstelle im Setup-Endpunkt von selbst gehosteten Metabase-Instanzen. Ohne den Patch können Angreifer die Validierung des Setup-Tokens...

CVE-2026-49360 Recce server has unauthenticated SQL execution that allows local file read/write through DuckDB

Recce is a data-validation toolkit for enhanced dbt data build tool PR review. Prior to version 1.50.0, OSS server deployments that expose the server to an untrusted network without authentication are vulnerable to unauthenticated SQL execution through the query run API. When Recce is configured...

One-Liner-Collections

One-Liner-Collections Este repositório contém uma lista de One-Liners com descrições e requisitos de instalação. ──────────────────────────────────────────────────────────────────────── Injeção SQL Requisitos de Instalação 1. Subfinder : https://github.com/projectdiscovery/subfinder 2. GAU :...

CVE-2026-76904

GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function; Requires...

GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers

Summary An SQL Injection Vulnerability has been found when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function Requires PostGIS 12 or greater with a String or JSON field For PostGIS 12 and greater jsonArrayContains, , function writes into generated SQL without...

EUVD-2026-64133

GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function; Requires...

CVE-2026-76904 GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers

GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function; Requires...

CVE-2026-76904 GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers

GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function; Requires...

CVE-2026-76904

GeoTools (open-source Java geospatial library) is affected by an unauthenticated SQL injection in the jsonArrayContains OGC Filter function within the PostGIS DataStore implementation. Affected versions are 30.5 through 33.5 (branch 33) and through 34.4 (branch 34). The root cause is that the pa...

vicidial-cve-2024-8503-blind-sqli-poc

vicidial-cve-2024-8503-blind-sqli-poc Proof of concept di SQL injection blind basata sul tempo non autenticata per l'endpoint VERMAJAXfunctions.php di VICIdial CVE-2024-8503. Il progetto è destinato esclusivamente a test di sicurezza autorizzati, validazione e formazione. Panoramica CVE-2024-8503...

PoC

PoC Repository di exploit proof of concept e strumenti. BMCRSCDRCE Exploit di esecuzione remota di comandi non autenticato per l'agente RSCD di BMC Server Automation. L'exploit funziona contro i server affetti da CVE-2016-1542 rilevato da Nessus. Questo è ora un modulo Metasploit, vedi...

Exploits

Exploits Exploit-POCs für reale Welt und CTFs. Reale Welt CVE| Kurzbeschreibung| Exploit ---|---|--- CVE-2017-5343| Wordpress SQL-Injection| POC CVE-2018-8880| Nicht authentifizierte Exfiltration von Netzwerkinformationen des Lutron Quantum Bacnet v2| POC CVE-2018-11629| Standard- und nicht...

CVE-2024-51482-ZoneMinder-CCTV-HTB-Reliable-EXP

README Macchina Hackthebox: CCTV Applicazione: ZoneMinder Descrizione Eseguire più iniezioni blind basate sul tempo per lo stesso carattere e selezionare il risultato più frequente riduce significativamente gli errori e migliora l'affidabilità, sebbene sia dispendioso in termini di tempo...

CVE-2026-56292-AcyMailing-SQLi

CVE-2026-56292 — AcyMailing for Joomla SQL Injection non autenticata Autore: nullwhisper Solo per ricerca di sicurezza autorizzata / validazione di vulnerabilità. AcyMailing for Joomla espone il task pubblico del front-end frontentityselect::loadEntityFront. Nelle versioni precedenti, il parametr...

CVE-2026-76613

Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injection allowed any contributor-level user to inject own content into SQL queries...

EUVD-2026-63937

Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injection allowed any contributor-level user to inject own content into SQL queries...

CVE-2026-76613 Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40

Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injection allowed any contributor-level user to inject own content into SQL queries...

CVE-2026-76613 Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40

Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injection allowed any contributor-level user to inject own content into SQL queries...