9 matches found
CVE-2026-39492
CVE-2026-39492 — WP Maps 블라인드 SQL 인젝션 스캐너 인증 없이 백틱 우회를 통한 시간 기반 블라인드 SQLi → DB 추출 개요 CVE-2026-39492 는 WP Maps 플러그인wp-google-map-plugin 버전 ≤ 4.9.1 에서 발견된 심각도CVSS 9.3의 인증되지 않은 블라인드 SQL 인젝션 취약점입니다. wpgmpajaxcall AJAX 핸들러는 wpajaxnopriv를 통해 인증되지 않은 접근에 등록됩니다. locationid 매개변수는...
CVE-2026-54646 CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.php
CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablename values into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE statements without validating the identifiers or escaping embedded backticks. An authenticated...
CVE-2026-54646
CubeCart (an ecommerce platform) is affected by a SQL identifier injection in admin/sources/maintenance.index.inc.php (line 551) prior to 6.7.5 . Administrator-supplied table names from POST parameters are wrapped in backticks and placed into structural SQL statements (ALTER TABLE, CHECK TABLE, A...
CVE-2026-54646 CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.php
CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablename values into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE statements without validating the identifiers or escaping embedded backticks. An authenticated...
CVE-2026-54646 CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.php
CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablename values into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE statements without validating the identifiers or escaping embedded backticks. An authenticated...
GHSA-79CW-HFCC-7MW9 Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes
Summary An authenticated user extracts the admin password hash and any other database content through a time-based blind SQL injection in the DateFilter column key parameter. The POST /pimcore-studio/api/website-settings endpoint and 11 other listing endpoints accepts a columnFilters array where...
Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection
Summary The terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to shellexec. After the fix for GHSA-9643-6xjp-vx57 which added $ to the blocklist, the characters | single pipe, backtick, and the newline byte 0x0A remain...
PT-2026-60697
Name of the Vulnerable Software and Affected Versions Pheditor versions 2.0.1 through 2.0.5 Description The terminal feature in Pheditor contains a flaw in how it sanitizes user-supplied commands before passing them to the shell exec function. While a blocklist is used to filter dangerous...
