The vulnerability of the Webasyst content management framework and the Shop-Script CMS system lies in the lack of measures to protect the SQL query structure, allowing attackers to execute arbitrary SQL code.

The vulnerability of the Webasyst framework for designing content management systems and the Shop-Script CMS system lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL code remotely...

The vulnerability of the Webasyst content management system and the Shop-Script CMS system lies in the lack of measures to protect the SQL query structure, allowing attackers to execute arbitrary SQL code.

The vulnerability of the Webasyst framework for designing content management systems and the Shop-Script CMS system lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary SQL code...

The vulnerability of the Webasyst content management system and the Shop-Script CMS system lies in the lack of measures to protect the SQL query structure, allowing attackers to execute arbitrary SQL code.

The vulnerability of the Webasyst framework for designing content management systems and the Shop-Script CMS system lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary SQL code...

The vulnerability of the Webasyst content management system and the Shop-Script CMS system lies in the lack of measures to protect the SQL query structure, allowing attackers to execute arbitrary SQL code.

The vulnerability of the Webasyst framework for designing content management systems and the Shop-Script CMS system lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary SQL code...

CVE-2023-50070

CVE-2023-50070 Customer Support System 1.0 - 複数のSQLインジェクション脆弱性 - saveticket 説明 : Customer Support System 1.0の /customersupport/ajax.php?action=saveticket における複数のSQLインジェクション脆弱性により、認証済みの攻撃者が departmentid、customerid、subject を介して任意のSQLコマンドを実行可能です。 脆弱性のある製品バージョン : Customer Support System 1.0 CVE作成者 :...

CVE-2021-24741

CVE-2021-24741 Support Board v 3.3.3 における複数のSQLインジェクション（未認証） 説明 Support Board V 3.3.3 Multiple SQL Injection Vulnerability in Support Board Version 3.3.3 that allow remote unauthenticated attacker to execute arbitrary SQL commands via statuscode, department, userid, conversationid,...

CVE-2023-50071

CVE-2023-50071 Customer Support System 1.0 - 複数の SQL インジェクション脆弱性 - savedepartment 説明 : Customer Support System 1.0 の /customersupport/ajax.php?action=savedepartment における複数の SQL インジェクションの脆弱性により、認証済み攻撃者が id または name を介して任意の SQL コマンドを実行できる可能性があります。 影響を受ける製品バージョン : Customer Support System 1.0 CVE 作成者...

rConfig <=3.9.4 - SQL Injection

rConfig 3.9.4 and prior has unauthenticated snippets.inc.php SQL injection. Because nodes' passwords are stored in cleartext by default, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices. id: CVE-2020-10549 info: name: rConfig 3.9.4 or apply th...

rConfig 3.9.4 - SQL Injection

rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection. Because nodes' passwords are stored by default in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices. id: CVE-2020-10547 info: nam...

TurboMeeting - Boolean-based SQL Injection

A Boolean-based SQL injection vulnerability in the "RHUB TurboMeeting" web application. This vulnerability could allow an attacker to execute arbitrary SQL commands on the database server, potentially allowing them to access sensitive data or compromise the server. id: CVE-2024-38289 info: name:...

Zabbix - SQL Injection

Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggleids array parameter in latest.php and perform SQL injection attacks. id: CVE-2016-10134 info: name: Zabbix - SQL Injection author: princechaddha severity: critical description: Zabbix...

Piwigo 13.7.0 - SQL Injection

Piwigo is open source photo gallery software. Prior to version 13.8.0, there is a SQL Injection vulnerability in the login of the administrator screen. The SQL statement that acquires the HTTP Header User-Agent is vulnerable at the endpoint that records user information when logging in to the...

CVE-2022-34265

CVE-2022-34265 使用方法 起動 docker-compose build docker-compose up -d 停止 docker-compose down Django の脆弱性 CVE-2022-34265 の PoC 検証 Django の脆弱性 CVE-2022-34265 が 2022年7月5日（米国時間）に公開されました。この記事では、本脆弱性に関する議論と検証結果について説明します。 脆弱性概要 本脆弱性は、Django で日付データに使用される関数 Trunc および Extract の引数に対して SQL...

CVE-2026-34220

CVE-2026-43220 Inyección SQL en MikroORM ★ PoC de Inyección SQL en MikroORM CVE-2026-43220 ★ https://github.com/user-attachments/assets/33724cfc-6151-47ff-9415-2f50c5124cd1 Descripción general CVE-2026-43220 es una vulnerabilidad de Inyección SQL en MikroORM , un framework ORM para...

EUVD-2026-90748

ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated attackers to execute arbitrary SQL during first-run setup mode. Attackers can invoke setup.restore via Socket.IO to plant admin users and forged session...

django-cve-2025-64459

Django CVE-2025-64459 このアプリケーションは、複数のDjangoバージョンに影響を与えるCVE-2025-64459を実演しています。この脆弱性は、新しいリリースのDjangoで修正されています。 SQLインジェクション SQLインジェクションとは、ユーザーが提供した入力がSQLクエリの一部として扱われることで、攻撃者がクエリの動作を変更し、本来アクセスできないデータを公開または改ざんできる脆弱性です。 脆弱性の説明...

Rocky Linux 8 [CIQ] Security Update: pg_repack / pg_repack-debuginfo / pg_repack-debugsource / pgaudit / etc (crlsa-2024_6000)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20246000 advisory. postgresql: PostgreSQL relation replacement during pgdump executes arbitrary SQL CVE-2024-7348 Tenable has extracted the preceding description block directly from t...

Rocky Linux 9 [CIQ] Security Update: pgaudit / pgaudit-debuginfo / pgaudit-debugsource / etc (crlsa-2024_0950)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20240950 advisory. postgresql: non-owner 'REFRESH MATERIALIZED VIEW CONCURRENTLY' executes arbitrary SQL CVE-2024-0985 Tenable has extracted the preceding description block directly...

Rocky Linux 9 [CIQ] Security Update: postgresql / postgresql-contrib / postgresql-contrib-debuginfo / etc (crlsa-2024_0951)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20240951 advisory. postgresql: non-owner 'REFRESH MATERIALIZED VIEW CONCURRENTLY' executes arbitrary SQL CVE-2024-0985 Tenable has extracted the preceding description block directly...

Rocky Linux 8 [CIQ] Security Update: cyrus-sasl / cyrus-sasl-debuginfo / cyrus-sasl-debugsource / etc (crlsa-2022_0658)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20220658 advisory. cyrus-sasl: failure to properly escape SQL input allows an attacker to execute arbitrary SQL commands CVE-2022-24407 Tenable has extracted the preceding description...