CVE-2021-22123

CVE-2021-22123 Fortinet FortiWeb Authenticated OS Command Injection Hit Counter The command injection vulnerability in the FortiWeb management interface may allow an authenticated remote attacker to execute arbitrary commands in the system via the SAML server configuration page. Executing command...

CVE-2026-65643-PoC-Toolkit

CVE‑2026‑65643 – cPanel Domain Parking RCE Toolkit ⚠️ ETHICAL USE ONLY – AUTHORIZED SECURITY TESTING This repository provides tools for authorized security professionals, blue teams, and penetration testers only. Unauthorized access to computer systems is illegal under CFAA US, Computer Misuse Act...

CVE-2024-36057

CVE-2024-36057 — Koha Library Software CVE ID: CVE-2024-36057 Product: Koha Library Software Vulnerability Type: OS Command Injection CWE-78 CVSS Score: 8.7 High Authenticated Affected Versions: Below 22.05.22 Credits: Karolis Narvilas Description Koha is an open-source integrated library system....

GHSA-FG9P-MRXR-HVQ7 Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)

Summary Orval emits the OpenAPI path into the generated request URL as a TEMPLATE LITERAL /users/... without escaping the backtick character. A path containing a backtick closes the template literal and injects a concatenation expression that is evaluated when the generated URL/request/key functi...

GHSA-88F2-FPV8-89Q2 Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)

Summary When Orval is configured with output.baseUrl.getBaseUrlFromSpecification: true, it bakes the spec's servers0.url into the generated request URL as a template literal without escaping the backtick. A server URL containing a backtick closes the template literal and injects a concatenation...

CVE-2026-5389

justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the tomarkdown function when serializing attacker-controlled pre content. Attackers can place backticks inside sanitized pre elements to break out of fixed-length code fences, allowing raw HTML to execute when the...

CVE-2026-73408 Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector

Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mysql.ts enabled multipleStatements and inserted an unescaped tableName into a DESCRIBE statement. An attacker able to create a MySQL table with a backtick and stacked statement in its name could wait...

CVE-2026-73408 Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector

Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mysql.ts enabled multipleStatements and inserted an unescaped tableName into a DESCRIBE statement. An attacker able to create a MySQL table with a backtick and stacked statement in its name could wait...

CVE-2026-73408

Budibase (open-source low-code platform) is affected up to version 3.39.18 in the MySQL integration code path, specifically packages/server/src/integrations/mysql.ts where multipleStatements is enabled and an unescaped tableName is inserted into a DESCRIBE statement. An attacker able to create a ...

CVE-2026-71292

Subrion CMS's admin grid sorting helper, gridGetSorting in includes/classes/ia.base.controller.admin.php, whitelists the ASC/DESC request parameter via inarray, but falls back to the raw, attacker-supplied GET parameter whenever the requested key is not present in the per-controller whitelist...

GHSA-2XGG-R2WC-C5R2 Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector

Summary This is a related but independently fixable vulnerability to GHSA-qqf5-x7mj-v43p PostgreSQL SQL injection, reported in the same original disclosure and split per GitHub CNA guidance rule 4.2.11 since it affects a separate integration, has a distinct attack precondition, and requires a...

PT-2026-61695

Name of the Vulnerable Software and Affected Versions Net::DNS versions prior to 1.56 Description Remote execution injection is possible via EDNS EXTENDED ERROR. The function decompose in Net::DNS::RR::OPT::EXTENDED ERROR parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option by tokenizing...

GHSA-WG4W-WR5Q-6VJC Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection

Summary The terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to shellexec. After the fix for GHSA-9643-6xjp-vx57 which added $ to the blocklist, the characters | single pipe, backtick, and the newline byte 0x0A remain...

vim security update

8.2.2637-26.0.1.el98.6 - Remove upstream references Orabug: 31197557 2:8.2.2637-26.6 - CVE-2026-41411 vim: Command injection via backticks in tag files 2:8.2.2637-26.5 - RHEL-170136 CVE-2026-35177 vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass 2:8.2.2637-26.4 -...

Improper Encoding or Escaping of Output

Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output through the Kubernetes Ingress and Knative provider buildRule/buildHostRule processes in the pkg/provider/kubernetes/ingress and pkg/provider/kubernetes/knative components. An attacker can bypass...

Improper Encoding or Escaping of Output

Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output through the Kubernetes Ingress and Knative provider buildRule/buildHostRule processes in the pkg/provider/kubernetes/ingress and pkg/provider/kubernetes/knative components. An attacker can bypass...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation in the doKey function of Neo4jVectorFilterExpressionConverter when a user-controlled string is embedded as a filter expression key without proper escaping of backticks. An attacker can access internal resources...

CVE-2026-29777 Traefik has a kubernetes gateway rule injection via unescaped backticks in HTTPRoute match values

Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.10, A tenant with write access to an HTTPRoute resource can inject backtick-delimited rule tokens into Traefik's router rule language via unsanitized header or query parameter match values. In shared gateway deployments, this can...

CVE-2026-29777 Traefik has a kubernetes gateway rule injection via unescaped backticks in HTTPRoute match values

Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.10, A tenant with write access to an HTTPRoute resource can inject backtick-delimited rule tokens into Traefik's router rule language via unsanitized header or query parameter match values. In shared gateway deployments, this can...

CVE-2026-29777

Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.10, A tenant with write access to an HTTPRoute resource can inject backtick-delimited rule tokens into Traefik's router rule language via unsanitized header or query parameter match values. In shared gateway deployments, this can...