CVE-2026-0603

CVE-2026-0603 Hibernate ORM 注入 / 二次 SQL 注入 ★ CVE-2026-0603 Hibernate SQL 注入 PoC ★ https://github.com/user-attachments/assets/2e7c3a89-e26f-48cd-af0b-8b82d32ce71f 概述 CVE-2026-0603 是 Hibernate ORM （一款广泛使用的 Java ORM 框架）中的 二次 SQL 注入 漏洞。 当包含恶意 SQL 载荷的用户提供字符串主键被用于批量 DELETE 或 UPDATE 操作时，Hibernate 会将该值直接...

CVE-2026-30951

CVE-2026-30951 Inyección SQL en el Cast de JSON de Sequelize ★ CVE-2026-30951 PoC de Inyección SQL en el ORM Sequelize ★ https://github.com/user-attachments/assets/30b19211-890a-4780-acd9-04856ec98381 Descripción general CVE-2026-30951 es una vulnerabilidad de Inyección SQL en Sequelize v6 , un O...

NocoBase - SQL Injection

NocoBase versions prior to 2.0.39 contain a SQL injection vulnerability in the @nocobase/database package. The queryParentSQL function in eager-loading-tree.ts constructs a recursive CTE query by directly concatenating user-controlled primary key values into the SQL WHERE IN clause without...

CVE-2024-54820

漏洞：未认证的SQL注入 - 明文凭据泄露 作者 ：Javier Carabantes 受影响软件 ：XOne Web Monitor 软件来源 ：https://xone.es/ 受影响版本 ：02.10.2024.530 framework 1.0.4.9 描述 在 XOne Web Monitor 版本 02.10.2024.530 framework 1.0.4.9 的登录功能中发现了一个未认证的SQL注入漏洞。此缺陷允许攻击者利用认证过程中对用户输入的不当处理，提取所有存储的用户名和密码。具体来说，登录端点的设计允许攻击者通过一个易受攻击的输入参数操纵 WHERE 子句。...

CVE-2025-6783

向 WHERE 子句中注入一个始终为真的条件，使每一行都匹配： root@kitploit: curl -i -X POST \ -H "Content-Type: application/json" \ -H "forms-id: poc-001' OR '1'='1' -- " \ -H "domain-id: example.com" \ -d ' "emabedtype":"iframe", "shortcodetitle":"INJECTED", "shortcodetag":"xss", "active":0 ' ...

RocketChat-NoSQLi-Chain-CVE-2021-22911

Rocket.Chat NoSQL注入令牌泄露与密码重置 一个针对 Rocket.Chat（及基于 Meteor 的应用程序）的自动利用脚本，利用 NoSQL 注入 通过 $where 子句中的服务器端异常泄露密码重置令牌。一旦令牌泄露，脚本将执行未经身份验证的密码重置。 漏洞概览 1. 身份验证 ：脚本以标准用户身份认证，以访问 /api/v1/users.list 端点。 2. NoSQL 注入 ：它使用 query 参数注入 $where JavaScript 子句。 3. 数据窃取 ：通过在注入中使用 throw 语句，强制服务器返回包含目标用户密码重置令牌的“未捕获异常”错误。...

BIT-GRAFANA-2026-19475 SQL Data Source Plugin: OOM DoS via $__timeGroup macro

An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory consumption that can...

CVE-2026-19475

Grafana is vulnerable to a denial of service via a bypass of the fix for CVE-2026-33375 . An authenticated user with permission to query a SQL data source can inject the timeGroup macro through a WHERE clause , which Grafana's regex-based macro parsing does not reject. Evaluating the injected mac...

CVE-2026-15993

The Form Maker by 10Web WordPress plugin (vulnerable up to 1.15.44) is affected by a blind SQL Injection in the Dynamic-Choice Field WHERE clause that references the {username} placeholder. Root cause: insufficient escaping of the user-supplied parameter and inadequate preparation of the existing...

CVE-2026-70369

Koha's reports/acquisitionsstats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled Filter request parameters directly into WHERE fragments covering aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.homebranch, items.ccode,...

CVE-2026-63755

SurrealDB before 3.1.0 evaluates user-supplied WHERE clauses in SELECT statements and SET/MERGE/CONTENT/PATCH clauses in UPDATE, UPSERT, INSERT ON DUPLICATE KEY UPDATE, and RELATE update-variant statements against full record data before enforcing PERMISSIONS FOR SELECT WHERE restrictions. An...

EUVD-2026-45926

SurrealDB before 3.1.0 evaluates user-supplied WHERE clauses in SELECT statements and SET/MERGE/CONTENT/PATCH clauses in UPDATE, UPSERT, INSERT ON DUPLICATE KEY UPDATE, and RELATE update-variant statements against full record data before enforcing PERMISSIONS FOR SELECT WHERE restrictions. An...

CVE-2026-63755

CVE-2026-63755 affects SurrealDB prior to 3.1.0. The bug evaluates user-supplied WHERE clauses (and related clauses in UPDATE/UPSERT/INSERT/RELATE) against full record data before applying table-level permissions, allowing an authenticated user to read full contents of any table in the current da...

CVE-2026-63755

SurrealDB before 3.1.0 evaluates user-supplied WHERE clauses in SELECT statements and SET/MERGE/CONTENT/PATCH clauses in UPDATE, UPSERT, INSERT ON DUPLICATE KEY UPDATE, and RELATE update-variant statements against full record data before enforcing PERMISSIONS FOR SELECT WHERE restrictions. An...

CVE-2026-63755 SurrealDB before 3.1.0 Permission Bypass via WHERE Clause

SurrealDB before 3.1.0 evaluates user-supplied WHERE clauses in SELECT statements and SET/MERGE/CONTENT/PATCH clauses in UPDATE, UPSERT, INSERT ON DUPLICATE KEY UPDATE, and RELATE update-variant statements against full record data before enforcing PERMISSIONS FOR SELECT WHERE restrictions. An...

CVE-2026-63755 SurrealDB before 3.1.0 Permission Bypass via WHERE Clause

SurrealDB before 3.1.0 evaluates user-supplied WHERE clauses in SELECT statements and SET/MERGE/CONTENT/PATCH clauses in UPDATE, UPSERT, INSERT ON DUPLICATE KEY UPDATE, and RELATE update-variant statements against full record data before enforcing PERMISSIONS FOR SELECT WHERE restrictions. An...

PT-2026-61571

SurrealDB before 3.1.0 evaluates user-supplied WHERE clauses in SELECT statements and SET/MERGE/CONTENT/PATCH clauses in UPDATE, UPSERT, INSERT ON DUPLICATE KEY UPDATE, and RELATE update-variant statements against full record data before enforcing PERMISSIONS FOR SELECT WHERE restrictions. An...

EUVD-2024-55683

SurrealDB versions before 2.0.4 fail to properly enforce field permissions during SELECT, UPDATE, and DELETE operations, allowing authorized users to access unauthorized field values through various query techniques. Attackers can exploit SELECT VALUE operations, field aliasing, function argument...

SUSE CVE-2026-15043

DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted = SQL operators on text. DBI::SQL::Nano, DBI's built-in mini-SQL engine, evaluated WHERE predicates incorrectly in some cases. In the non-numeric string branch of the ismatched method, = was evaluated using Perl's le operator...

ALPINE-CVE-2026-15043

DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted = SQL operators on text. DBI::SQL::Nano, DBI's built-in mini-SQL engine, evaluated WHERE predicates incorrectly in some cases. In the non-numeric string branch of the ismatched method, = was evaluated using Perl's le operator...