The vulnerability of the Webasyst content management system and the Shop-Script CMS system lies in the lack of measures to protect the SQL query structure, allowing attackers to execute arbitrary SQL code.

The vulnerability of the Webasyst framework for designing content management systems and the Shop-Script CMS system lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary SQL code...

CVE-2022-34265

CVE-2022-34265 Uso iniciar root@kitploit: docker-compose build docker-compose up -d detener root@kitploit: docker-compose down Verificación PoC de la vulnerabilidad de Django CVE-2022-34265 Una vulnerabilidad CVE-2022-34265 en Django fue divulgada el 5 de julio de 2022 hora de EE. UU.. Este...

CVE-2024-50972

CVE-2024-50972 描述 Itsourcecode Construction Management System 1.0 的 printtool.php 中存在 SQL 注入漏洞，允许远程攻击者通过 borrowid 参数执行任意 SQL 命令。 漏洞类型 SQL 注入 产品厂商 Itsourcecode 受影响产品代码库： https://itsourcecode.com/free-projects/php-project/construction-management-system-project-in-php-with-source-code/ - 1.0 受影响组件：...

CVE-2024-50971

CVE-2024-50971 描述 Itsourcecode Construction Management System 1.0 的 print.php 中存在一个 SQL 注入漏洞，允许远程攻击者通过 mapid 参数执行任意 SQL 命令。 漏洞类型 SQL 注入 供应商 Itsourcecode 受影响产品代码库： https://itsourcecode.com/free-projects/php-project/construction-management-system-project-in-php-with-source-code/ - 1.0 受影响组件：...

EUVD-2026-83435

IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command...

CVE-2026-84073 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command...

CVE-2026-84073

IBM Guardium Data Protection 12.2 is affected by a SQL injection flaw (CWE-89) that allows a remote authenticated attacker to execute arbitrary SQL commands through improper neutralization of special elements in an SQL command. The CVSS 3.1 score is 9.1 (CRITICAL) with a changed scope , indicatin...

EUVD-2026-83423

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command...

CVE-2026-84064

IBM Guardium Data Protection 12.2 is vulnerable to SQL injection (CWE-89) caused by improper neutralization of special elements used in an SQL command. A remote authenticated attacker can execute arbitrary SQL commands, leading to high impact on confidentiality, integrity, and availability. The C...

CVE-2025-67644-LangGraph-3.0.1-SQLite-Checkpoint-SQL-Injection

CVE-2025-67644 PoC – LangGraph SQLite 检查点 SQL 注入 CVE-2025-67644 是 langgraph-checkpoint-sqlite 包（属于 LangGraph / LangChain 生态）中的一个 SQL 注入 漏洞（CWE-89）。 攻击者可通过传递给 SqliteSaver 的 list / 方法的未经净化的注入任意 SQL。...

sparx_hack

Sparx Pro Cloud Server 和 Enterprise Architect 中的多个漏洞 用于在无需身份验证的情况下在 Sparx PCS 服务器上执行任意 SQL 命令的漏洞利用代码。 注意：密钥 不正确 是为了防止脚本小子轻易破解 ;- 完整文章：https://sploit.tech/2026/05/19/Sparx-Enterprise-Architect-PCS.html 致谢：br0x https://sploit.tech/ 团队：Efigo https://efigo.pl...

CVE-2025-59213

Exploit de inyección SQL no autenticada CVE-2025-59213 en Microsoft Configuration Manager ConfigMgr / SCCM 2503 Este script explota la vulnerabilidad CVE-2025-59213, que permite a un atacante no autenticado con acceso de red a un punto de administración Management Point ejecutar consultas SQL...

Astra Linux – Vulnerability in PostgresSQL 11

A flaw was discovered in PostgreSQL versions prior to 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20, and before 9.5.24. An attacker who has permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The...

PT-2026-91196

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized entityKey and opEvent parameters. This issue affects...

PT-2026-89878

CVE-2026-82583 CVSS 8.3 impacts Mirth Connect 4.7.1 and earlier. Authenticated users can execute arbitrary SQL via Database Connector, risking stored credential disclosure. Update if deployed. via NVD Recent High CVSS CyberSecurity InfoSec Vulnerability https://t.co/xBS3E6mUo3...

CVE-2026-76009 Next-Cart Store to WooCommerce Migration <= 3.9.8 - Unauthenticated Authentication Bypass via Default '__token__' Fallback in REST Migration Endpoint

The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.9.8 via the NCWMKitconnect::run function. This is due to the plugin registering the /wp-json/nextcart/v1/migration REST route with permissioncallback se...

CVE-2026-86123

SQL Chat contains four unauthenticated API endpoints that accept client-supplied database connection parameters and execute arbitrary SQL queries against attacker-specified hosts. Attackers can connect to internal databases, execute SQL commands, enumerate schemas, and pivot into the server's...

SiYuan: Unauthenticated arbitrary SQL execution via searchEmbedBlock (publish mode) : reader-reachable raw statement on read-write handle, cross-notebook read/write

CVE: This vulnerability corresponds to CVE-2026-69084. Summary The /api/search/searchEmbedBlock endpoint passes a client-supplied SQL statement verbatim to the database with no validation. The endpoint is gated by CheckAuth only reachable by the publish RoleReader token, and by the anonymous...

CVE-2026-74820

ServiceNow has remediated a SQL injection vulnerability that was identified in in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gain access to, or...

GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers

Summary An SQL Injection Vulnerability has been found when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function Requires PostGIS 12 or greater with a String or JSON field For PostGIS 12 and greater jsonArrayContains, , function writes into generated SQL without...