The vulnerability of the Webasyst content management framework and the Shop-Script CMS system lies in the lack of measures to protect the SQL query structure, allowing attackers to execute arbitrary SQL code.

The vulnerability of the Webasyst framework for designing content management systems and the Shop-Script CMS system lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL code remotely...

The vulnerability of the Webasyst content management system and the Shop-Script CMS system lies in the lack of measures to protect the SQL query structure, allowing attackers to execute arbitrary SQL code.

The vulnerability of the Webasyst framework for designing content management systems and the Shop-Script CMS system lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary SQL code...

The vulnerability of the Webasyst content management system and the Shop-Script CMS system lies in the lack of measures to protect the SQL query structure, allowing attackers to execute arbitrary SQL code.

The vulnerability of the Webasyst framework for designing content management systems and the Shop-Script CMS system lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary SQL code...

The vulnerability of the Webasyst content management system and the Shop-Script CMS system lies in the lack of measures to protect the SQL query structure, allowing attackers to execute arbitrary SQL code.

The vulnerability of the Webasyst framework for designing content management systems and the Shop-Script CMS system lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary SQL code...

CVE-2021-24741

CVE-2021-24741 Support Board v 3.3.3 中的多个SQL注入（未认证） 描述 root@kitploit: Support Board V 3.3.3 Support Board 3.3.3 版本中存在多个SQL注入漏洞，允许远程未认证攻击者通过 statuscode、department、userid、conversationid、conversationstatuscode 和 recipientid 参数向 ajax.php 执行任意SQL命令，ajax.php 连接至 functions.php，漏洞即存在于该处。 脆弱参数 功能| 脆弱参数|...

CVE-2023-50070

CVE-2023-50070 Customer Support System 1.0 - 多处 SQL 注入漏洞 - saveticket 描述 ：Customer Support System 1.0 中 /customersupport/ajax.php?action=saveticket 存在多处 SQL 注入漏洞，允许已认证的攻击者通过 departmentid、customerid 和 subject 参数执行任意 SQL 命令。 受影响产品版本 ：Customer Support System 1.0 CVE 作者 ：Geraldo Alcântara 日期 ：2023 年 ...

rConfig <=3.9.4 - SQL Injection

rConfig 3.9.4 and prior has unauthenticated snippets.inc.php SQL injection. Because nodes' passwords are stored in cleartext by default, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices. id: CVE-2020-10549 info: name: rConfig 3.9.4 or apply th...

Piwigo 13.7.0 - SQL Injection

Piwigo is open source photo gallery software. Prior to version 13.8.0, there is a SQL Injection vulnerability in the login of the administrator screen. The SQL statement that acquires the HTTP Header User-Agent is vulnerable at the endpoint that records user information when logging in to the...

CVE-2022-34265

CVE-2022-34265 使用方法 启动 root@kitploit: docker-compose build docker-compose up -d 停止 root@kitploit: docker-compose down Django 漏洞（CVE-2022-34265）的 PoC 验证 Django 中的一个漏洞（CVE-2022-34265）于 2022 年 7 月 5 日（美国时间）公开。本文介绍我们对该漏洞的讨论以及验证结果。 漏洞摘要 该漏洞是由于 Django 中对用于日期数据的函数 Trunc 和 Extract 的参数执行 SQL...

EUVD-2026-76115

NextGen Connect Mirth Connect versions 4.7.1 and earlier allow an authenticated user to execute arbitrary SQL through a Database Connector API, which could result in disclosure of stored credentials for connected systems, arbitrary file write, and a denial-of-service condition...

CVE-2023-50071

CVE-2023-50071 Customer Support System 1.0 - 多个SQL注入漏洞 - savedepartment 描述 ：在 Customer Support System 1.0 的 /customersupport/ajax.php?action=savedepartment 中存在多个SQL注入漏洞，允许认证攻击者通过 id 或 name 参数执行任意SQL命令。 受影响产品版本 ：Customer Support System 1.0 CVE作者 ：Geraldo Alcantara 日期 ：2023年11月29日 CVE ：CVE-2023-500...

CVE-2024-40443

CVE-2024-40443 CVE-2024-40443 - 计算机实验室管理系统 v1.0 中的一个 SQL 注入漏洞允许攻击者执行任意 SQL 命令。...

rConfig 3.9.4 - SQL Injection

rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection. Because nodes' passwords are stored by default in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices. id: CVE-2020-10547 info: nam...

TurboMeeting - Boolean-based SQL Injection

A Boolean-based SQL injection vulnerability in the "RHUB TurboMeeting" web application. This vulnerability could allow an attacker to execute arbitrary SQL commands on the database server, potentially allowing them to access sensitive data or compromise the server. id: CVE-2024-38289 info: name:...

PT-2026-89878

NextGen Connect Mirth Connect versions 4.7.1 and earlier allow an authenticated user to execute arbitrary SQL through a Database Connector API, which could result in disclosure of stored credentials for connected systems, arbitrary file write, and a denial-of-service condition...

CVE-2026-72550-poc

CVE-2026-72550 — Inyección SQL no autenticada en Friendica La inyección SQL de consultas apiladas no autenticada en el endpoint de fotos de Friendica permite que cualquier visitante ejecute SQL arbitrario...

CVE-2024-34222

人力资源管理系统 1.0 提交者：Kha Do 漏洞 SQL注入 描述 SourceCodester人力资源管理系统1.0中的/hrm/country.php存在SQL注入漏洞，允许攻击者通过searccountry 参数执行任意SQL命令。 受影响组件 路径 URL: /hrm/country.php 参数: & searccountry=在此处注入 影响 此漏洞允许攻击者通过searccountry 参数执行任意SQL命令。 POC 当使用错误条件 ' and '1'='2' 搜索国家时，没有返回结果： 并且，当使用错误条件 ' and '1'='1' 搜索国家时，所有结果都返回：...

Zabbix - SQL Injection

Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggleids array parameter in latest.php and perform SQL injection attacks. id: CVE-2016-10134 info: name: Zabbix - SQL Injection author: princechaddha severity: critical description: Zabbix...

django-cve-2025-64459

Django CVE-2025-64459 该应用程序演示了影响多个 Django 版本的 CVE-2025-64459。该漏洞已在 Django 的新版本中修复。 SQL 注入 SQL 注入是指将用户提供的输入作为 SQL 查询的一部分处理，从而使攻击者能够改变查询的工作方式，并暴露或修改其本应无权访问的数据。 漏洞描述 这是 Django QuerySets 和 Q 对象中的一个 SQL 注入漏洞，可能导致数据泄露。该漏洞的利用方式是将查询参数传递给 Django QuerySet，用户能够设置 connector 和 negated 键来执行任意 SQL 片段。...

CVE-2025-67644-LangGraph-3.0.1-SQLite-Checkpoint-SQL-Injection

CVE-2025-67644 PoC – LangGraph SQLite 检查点 SQL 注入 CVE-2025-67644 是 langgraph-checkpoint-sqlite 包（属于 LangGraph / LangChain 生态）中的一个 SQL 注入 漏洞（CWE-89）。 攻击者可通过传递给 SqliteSaver 的 list / 方法的未经净化的注入任意 SQL。...