CVE-2024-57430

CVE-2024-57430 PHPJabbers Cinema Booking System v2.0 的 pjActionGetUser 函数中存在一个 SQL 注入漏洞，允许攻击者通过 column 参数操纵数据库查询。利用该缺陷可导致未授权信息泄露、权限提升或数据库篡改。 漏洞参数：column 影响： SQL 注入可导致未授权访问敏感信息、数据库篡改，甚至数据库服务器被完全攻陷。这对应用程序的机密性、完整性和可用性构成严重威胁。 漏洞利用 - 概念验证（POC） SQL 注入 对 URL 发起 GET...

CVE-2025-57833

Django FilteredRelation Alias SQL注入漏洞CVE-2025-57833 Django时隔一年爆出来的SQL注入漏洞，大概一看大概是别名引起的注入（毕竟别名是无法预编译的 ） 该漏洞影响 Django 框架中的 FilteredRelation 功能，当使用 QuerySet.annotate 或 QuerySet.alias方法，并通过 Python 的字典扩展 kwargs 提供列别名时，存在 SQL 注入风险。这是由于对字典键（即列别名）未进行充分验证，导致攻击者可构造恶意字典注入不受限制的 SQL 语句 该漏洞的影响范围为 Django 4.2 之前...

CVE-2021-28079

CVE-2021-28079 - 概念验证 Jamovi file example.omv example.omv: Zip archive data, at least v2.0 to extract 所有 OMV 文件都是归档数据。因此，你可以解压它并修改以利用 XSS 漏洞。 root@kitploit: 🔥\ unzip example.omv Archive: example.omv inflating: META-INF/MANIFEST.MF inflating: index.html inflating: metadata.json inflating: xdata.js...

CVE-2026-54181

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, src/resources/views/crud/columns/color.blade.php inverts the escaped and raw rendering branche...

EUVD-2026-77720

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, src/resources/views/crud/columns/color.blade.php inverts the escaped and raw rendering branche...

CVE-2026-54181

backpack/crud (a Laravel admin-panel CRUD package) contains a Stored XSS in the color column Blade template (color.blade.php). The escaped/unescaped rendering branches are inverted relative to all other column templates, so because $column['escaped'] defaults to true, stored values are rendered u...

CVE-2026-54181 backpack/crud: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, src/resources/views/crud/columns/color.blade.php inverts the escaped and raw rendering branche...

CVE-2026-54181 backpack/crud: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, src/resources/views/crud/columns/color.blade.php inverts the escaped and raw rendering branche...

CVE-2026-54529

SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to 0.27.1, ModelView.sortquery in sqladmin/models.py accepts the attacker-controlled sortBy list-view query parameter without enforcing the configured columnsortablelist server-side allow-list in self.sortfields. The value is...

CVE-2024-23995

Beekeeper-Studio PoC Una prueba de concepto para la vulnerabilidad CVE-2024-23995. 1. Resumen de la vulnerabilidad: Sujeto de la vulnerabilidad: RCE a través de XSS Versión vulnerable: = Beekeeper-Studio-4.1.13 Tipo de ataque: Ejecución remota de código Vectores de ataque: Para explotar la...

Astra Linux – Vulnerability in SQLite3

SQLite 3.30.1 improperly handles pExpr-y.pTab, as demonstrated by the TKCOLUMN case in sqlite3ExprCodeTarget in expr.c...

CVE-2026-85188 Joomla Extension - regularlabs.com - Database data disclosure in Advanced Module Manager (Free, Pro) < 12.1.0, Conditional Content (Free, Pro) < 8.0.0, Content Templater (Pro) < 14.2.0, ReReplacer (Pro) < 16.2.0 for Joomla

Joomla Extension - regularlabs.com - Database data disclosure in Advanced Module Manager Free, Pro 12.1.0, Conditional Content Free, Pro 8.0.0, Content Templater Pro 14.2.0, ReReplacer Pro 16.2.0 for Joomla - The Conditions editor creates a default Condition Set name from the item to which the se...

CVE-2017-16082

CVE-2017-16082 概述 受影响版本的 pg 存在一个远程代码执行漏洞，当远程数据库或查询指定了精心构造的列名时触发。 以下两种场景下应用程序容易受到攻击： 1. 应用程序执行不安全的、用户提供的 SQL，其中包含恶意的列名。 2. 应用程序连接到不受信任的数据库并执行查询，返回的结果包含恶意的列名。 概念验证 root@kitploit: const Client = require'pg' const client = new Client client.connect const sql = SELECT 1 AS "\'/", 2 AS "\'/\n +...

Linux Distros Unpatched Vulnerability : CVE-2026-72708

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the public sitemap endpoint where the MySQL escaper spipmysqlcite in...

WordPress Admin Word Count Column 2.2 - Local File Inclusion

The plugin does not validate the path parameter given to readfile, which could allow unauthenticated attackers to read arbitrary files on server running old version of PHP susceptible to the null byte technique. This could also lead to RCE by using a Phar Deserialization technique. id:...

CVE-2021-35042

CVE-2021-35042 Django SQL注入漏洞 问题：探索它的可利用程度有多大？ 答案：我很害怕 安装 poetry install poetry run ./manage.py migrate poetry run ./manage.py loaddata dummydata.json 交互式演示 poetry run ./manage.py runserver 按随机字段排序 访问 http://localhost:8000/?orderby=%22corethingstags%22.%22thingsid%22 注意，?orderby 参数传递了一个原始SQL引用，指向...

CVE-2026-90511

A vulnerability was detected in GongShengyue OnlineBooks up to dfc5eacc08d3b0396c266049548618f6fb9587ea. This vulnerability affects unknown code of the file src/cn/ylcto/book/servlet/BooksServlet.java of the component listSplit Interface. The manipulation of the argument column results in sql...

CVE-2026-90773 procs through 0.14.12 Terminal Escape Sequence Injection via Command

procs through 0.14.12 fails to sanitize escape sequences in process command lines before displaying them in the Command column. Local attackers can execute processes with malicious ANSI or OSC escape sequences in their command line arguments, which are written unmodified to other users' terminals...

CVE-2026-90511

A SQL injection vulnerability exists in GongShengyue OnlineBooks (up to commit dfc5eacc) in the listSplit interface of the file src/cn/ylcto/book/servlet/BooksServlet.java. Manipulation of the column argument allows a remote, low-privilege attacker to inject SQL, impacting confidentiality, integr...

EUVD-2026-76984

A vulnerability was detected in GongShengyue OnlineBooks up to dfc5eacc08d3b0396c266049548618f6fb9587ea. This vulnerability affects unknown code of the file src/cn/ylcto/book/servlet/BooksServlet.java of the component listSplit Interface. The manipulation of the argument column results in sql...