WordPress Admin Word Count Column 2.2 - Local File Inclusion

The plugin does not validate the path parameter given to readfile, which could allow unauthenticated attackers to read arbitrary files on server running old version of PHP susceptible to the null byte technique. This could also lead to RCE by using a Phar Deserialization technique. id:...

CVE-2025-57833

Django FilteredRelation Alias SQL注入漏洞CVE-2025-57833 Django时隔一年爆出来的SQL注入漏洞，大概一看大概是别名引起的注入（毕竟别名是无法预编译的 ） 该漏洞影响 Django 框架中的 FilteredRelation 功能，当使用 QuerySet.annotate 或 QuerySet.alias方法，并通过 Python 的字典扩展 kwargs 提供列别名时，存在 SQL 注入风险。这是由于对字典键（即列别名）未进行充分验证，导致攻击者可构造恶意字典注入不受限制的 SQL 语句 该漏洞的影响范围为 Django 4.2 之前...

CVE-2021-35042

CVE-2021-35042 Django SQL注入漏洞 问题：探索它的可利用程度有多大？ 答案：我很害怕 安装 poetry install poetry run ./manage.py migrate poetry run ./manage.py loaddata dummydata.json 交互式演示 poetry run ./manage.py runserver 按随机字段排序 访问 http://localhost:8000/?orderby=%22corethingstags%22.%22thingsid%22 注意，?orderby 参数传递了一个原始SQL引用，指向...

CVE-2024-57430

CVE-2024-57430 Una vulnerabilidad de inyección SQL en la función pjActionGetUser de PHPJabbers Cinema Booking System v2.0 permite a los atacantes manipular consultas de la base de datos a través del parámetro column. Explotar esta falla puede provocar divulgación no autorizada de información,...

CVE-2026-90511

A SQL injection vulnerability exists in GongShengyue OnlineBooks (up to commit dfc5eacc) in the listSplit interface of the file src/cn/ylcto/book/servlet/BooksServlet.java. Manipulation of the column argument allows a remote, low-privilege attacker to inject SQL, impacting confidentiality, integr...

EUVD-2026-76984

A vulnerability was detected in GongShengyue OnlineBooks up to dfc5eacc08d3b0396c266049548618f6fb9587ea. This vulnerability affects unknown code of the file src/cn/ylcto/book/servlet/BooksServlet.java of the component listSplit Interface. The manipulation of the argument column results in sql...

CVE-2024-23995

Beekeeper-Studio PoC 针对CVE-2024-23995漏洞的概念验证。 1.漏洞概述： 漏洞主题：通过XSS实现远程代码执行 影响版本：= Beekeeper-Studio-4.1.13 攻击类型：远程代码执行 攻击向量：为利用此漏洞，需在表列名中插入恶意脚本。当鼠标悬停在对应列（tabulator-header-contents）上时，预览（tabulator-popup-container）应被执行，从而允许利用发生。 预留CVE编号：CVE-2024-23995 2.漏洞成因： 概念验证（PoC） 步骤1）创建包含恶意脚本列名的数据库。...

CVE-2021-28079

CVE-2021-28079 - POC Jamovi file example.omv example.omv: Zip archive data, at least v2.0 to extract Todos los archivos OMV son datos archivados. Por lo tanto, puedes extraerlo y modificarlo para explotar el bug XSS. root@kitploit: 🔥\ unzip example.omv Archive: example.omv inflating:...

CVE-2026-72708

SPIP before 4.4.18 is affected by an unauthenticated blind SQL injection in the public sitemap endpoint. The root cause lies in the MySQL escaper spip_mysql_cite() (in ecrire/req/mysql.php), which returns values unescaped when the target column is a date type and the input matches a word characte...

CVE-2026-88890 OpenPanel SQL Injection via unvalidated profile filter column identifier

OpenPanel through commit cd24bb8 contains an SQL injection vulnerability in the analytics filter builder that fails to validate profile. filter column identifiers before interpolating them into ClickHouse WHERE clauses. An authenticated attacker with project-scoped read or root export credentials...

CVE-2026-88890

OpenPanel through commit cd24bb8 contains an SQL injection vulnerability in the analytics filter builder . The root cause is a failure to validate profile.* filter column identifiers before interpolating them into ClickHouse WHERE clauses . An authenticated attacker holding project-scoped read or...

CVE-2026-1312

CVE-2026-1312 es una vulnerabilidad de inyección SQL de alto riesgo en Django: cuando se utiliza un alias de columna que contiene puntos en QuerySet.orderby, combinado con FilteredRelation para construir dinámicamente consultas mediante expansión de diccionarios, un atacante puede inyectar SQL...

CVE-2026-78837

CVE-2026-78837 Descripción Una vulnerabilidad de inyección SQL en el parámetro apformid en AppNitro MachForm v30 permite a los atacantes acceder a información sensible de la base de datos mediante una declaración SQL manipulada. Componente afectado Probado en MachForm - Versión 30 Tipo de ataque...

EUVD-2026-74946

Snipe-IT versions before 8.7.0 contain an improper ownership management vulnerability in the consumables checkout API endpoint that records the checkout target user's id in the createdby column instead of the authenticated caller's id. Authenticated attackers with consumables.checkout permission...

PT-2026-89205

Summary ModelView.sort query uses the attacker-controlled sortBy list-view query parameter without checking it against the configured column sortable list allow-list. The value is resolved with getattrmodel, ... and fed into relationship joins and order by, so a request can sort by any column of...

1CMS 5.6 Cross Site Scripting

1CMS version 5.6 suffers from a persistent cross site scripting vulnerability. https://packetstorm.news/download/231034...

CVE-2017-16082

CVE-2017-16082 概述 受影响版本的 pg 存在一个远程代码执行漏洞，当远程数据库或查询指定了精心构造的列名时触发。 以下两种场景下应用程序容易受到攻击： 1. 应用程序执行不安全的、用户提供的 SQL，其中包含恶意的列名。 2. 应用程序连接到不受信任的数据库并执行查询，返回的结果包含恶意的列名。 概念验证 root@kitploit: const Client = require'pg' const client = new Client client.connect const sql = SELECT 1 AS "\'/", 2 AS "\'/\n +...

CVE-2026-52307

An authenticated stored cross-site scripting XSS vulnerability in the Column Management component of ClassCMS 1CMS v5.6 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the title field...

CVE-2026-52307

CVE-2026-52307: Vulnerabilidad XSS Almacenado Autenticado en 1CMS v5.6 Introducción Este repositorio contiene la reproducción de CVE-2026-52307 , una vulnerabilidad de cross-site scripting XSS almacenado autenticado descubierta en 1CMS v5.6 anteriormente ClassCMS. Se proporciona una prueba de...

CVE-2026-52307

An authenticated stored XSS vulnerability exists in the Column Management component of ClassCMS 1CMS v5.6 . An attacker with valid credentials can inject a crafted payload into the title field , resulting in the execution of arbitrary web scripts or HTML in other users' browsers. The vulnerabilit...