CVE-2025-68999-POC

CVE-2025-68999 Happy Addons for Elementor prepare 安全地获取行，但随后将 $entry-metakey 直接插入 SQL 字符串而不进行转义： root@kitploit: $records = " $duplicatedpostid, '$entry-metakey', '$value' "; // ... $wpdb-query $query ; 由于 metakey 来自数据库，代码将其视为可信。但贡献者可以通过自定义字段面板设置任意字段名称——因此他们控制该列中的内容。 攻击分为两步： 1. 写入：...

CVE-2026-52771

YesWiki (PHP wiki system) versions 4.2.0 through 4.6.5 are affected by a second-order SQL injection in ApiController::deletePage(). A page tag containing a single quote is stored intact during insertion (the INSERT escapes it for SQL, but the raw byte persists), then read back unescaped into DELE...

CVE-2026-19949

The All-in-One WP Migration and Backup WordPress plugin (all versions up to and including 7.109 ) is susceptible to a second-order SQL injection in its archive restore functionality, caused by insufficient escaping of a user-supplied parameter and inadequate preparation of the existing SQL query....

SQLi (SQL Injection) org.hibernate:hibernate-core-jakarta Dependency in Bamboo Data Center

This High severity SQLi SQL Injection vulnerability was introduced in version 12.1.0 of Bamboo Data Center. This SQLi SQL Injection vulnerability, with a CVSS Score of 8.3 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L allows an authenticated attacker to forward a malicious que...

SQLi (SQL Injection) org.hibernate:hibernate-core-jakarta Dependency in Crowd Data Center

This High severity SQLi SQL Injection vulnerability was introduced in versions 6.0.0, 6.1.0, 6.2.0, 6.3.0, 7.0.0, 7.1.0, and 7.2.0 of Crowd Data Center. This SQLi SQL Injection vulnerability, with a CVSS Score of 8.3 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L allows an...