wp2shell-PoC

wp2shell-PoC ⚠ Dieses Tool dient ausschließlich zu Bildungs- oder Bug-Bounty-Zwecken. Unautorisierte Nutzung außerhalb kontrollierter Umgebungen ist strengstens untersagt. Übersicht Proof-of-Concept für die wp2shell-Verwundbarkeitskette, die den WordPress Core betrifft und CVE-2026-63030 mit...

EUVD-2026-63775

Improper input validation and Exposure of sensitive information through data queries vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, and Genians Genian ZTNA V6.0 allows SQL Injection and Authentication Bypass. This issue affects Genian NAC V4.0: from 4.0.0 before 4.0.175Revisio...

EUVD-2026-63690

Improper neutralization of special elements used in an sql command 'sql injection' in Azure SQL Database allows an authorized attacker to elevate privileges over a network...

EUVD-2026-63624

Improper neutralization of special elements used in an sql command 'sql injection' in Azure SQL Database allows an authorized attacker to elevate privileges over a network...

CVE-2026-16520

Improper input validation and Exposure of sensitive information through data queries vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, and Genians Genian ZTNA V6.0 allows SQL Injection and Authentication Bypass. This issue affects Genian NAC V4.0: from 4.0.0 before 4.0.175Revisio...

php:8.2 security, bug fix, and enhancement update

An update is available for module.libzip, php, module.php-pecl-rrd, php-pecl-apcu, module.php-pecl-apcu, libzip, php-pecl-zip, module.php-pecl-zip, php-pecl-rrd, module.php, php-pear, module.php-pear, php-pecl-xdebug3, module.php-pecl-xdebug3. This update affects Rocky Linux 8. A Common...

Cisco Unified Intelligence Center < 12.6 / 12.6.x < 12.6(2) ES08 / 15.0.x < 15.0(1) SU2 SQL Injection (cisco-sa-cuic-sql-inject-2qbfWSm5)

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL injection attack against an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker coul...

RockyLinux 8 : php:8.2 (RLSA-2026:57574)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:57574 advisory. php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archiv...

The vulnerability of the Metabase data visualization and reporting software lies in the lack of security measures for query structures, allowing attackers to enhance their privileges and execute arbitrary code.

The vulnerability of the Metabase data visualization and reporting software relates to the lack of measures taken to protect the SQL query structure during the processing of the resetpassword parameter. Exploiting this vulnerability allows a malicious actor to enhance their privileges and execute...

PT-2026-79381

Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injection allowed any contributor-level user to inject own content into SQL queries...

PT-2026-79450

Name of the Vulnerable Software and Affected Versions GeoTools versions 30.5 through 33.5 GeoTools version 34.4 Description An SQL injection flaw exists when executing OGC Filters with the PostGIS DataStore implementation. The issue occurs within the jsonArrayContains function, which fails to...

VulnCheck KEV: CVE-2026-76904

GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function; Requires...

CVE-2026-16520

Improper input validation and Exposure of sensitive information through data queries vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, and Genians Genian ZTNA V6.0 allows SQL Injection and Authentication Bypass. This issue affects Genian NAC V4.0: from 4.0.0 before 4.0.175Revisio...

CVE-2026-16520

Genians Genian NAC V4.0, V5.0, and Genian ZTNA V6.0 contain improper input validation enabling SQL injection and authentication bypass (CVSS 8.7 HIGH). Affected versions: NAC V4.0 before 4.0.175, V5.0 before 5.0.88, ZTNA V6.0 before 6.0.48. No in-the-wild exploitation reported. Patch to the liste...

CVE-2026-68782

Improper neutralization of special elements used in an sql command 'sql injection' in Azure SQL Database allows an authorized attacker to elevate privileges over a network...

CVE-2026-68789

Improper neutralization of special elements used in an sql command 'sql injection' in Azure SQL Database allows an authorized attacker to elevate privileges over a network...

CVE-2026-46682

BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton allowed authenticated moderators to inject SQL through the meetingId and userId values used by refreshBreakoutRoomsVisibleForUsers in akka-bbb-apps/src/main/scala/org/bigbluebutton/core/db/BreakoutRoomUserDAO.scala...

CVE-2026-68782

An SQL injection flaw in Azure SQL Database allows an authenticated, low-privilege network attacker to elevate privileges, with CVSS 9.9 (Critical) reflecting full confidentiality, integrity, and availability impact. Microsoft's update guide is the primary remediation reference; no patch version ...

CVE-2026-68789

CVE-2026-68789 is a SQL injection vulnerability in Azure SQL Database that allows an authorized attacker to elevate privileges over a network. The vulnerability is rated CVSS 9.9 (CRITICAL) with a scope change, indicating high impact on confidentiality, integrity, and availability. CISA's SSVC as...

CVE-2026-55769

CloudNativePG (a Kubernetes operator for PostgreSQL) is vulnerable to privilege escalation to superuser in versions prior to 1.28.4 and 1.29.2 . The root cause is that superuser connections in fillDefaultParameters (pkg/management/postgres/pool/profiles.go) did not pin search_path. An attacker wi...