net/mail: golang: net/mail: Denial of Service via pathological email address parsing

A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...

net/mail: golang: net/mail: Denial of Service via pathological email address parsing

A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...

CVE-2026-31891

MongoLite集約オプティマイザーのtoJsonExtractRawにおけるSQLインジェクション 脆弱性クラス : SQLインジェクション CWE-89 製品 : Cockpit CMS Core Edition 影響を受けるバージョン : 2.13.4、および集約オプティマイザーが導入されて以降の全バージョンの可能性が高い テスト済みDockerイメージ : cockpithq/cockpit:core-2.13.4 ソースコミット : 7fe563023b7fae854c857d2e2dc0878ef28fbb5f タグ 2.13.4 GitHub :...

CVE-2026-32599

Netmaker makes networks with WireGuard. Prior to version 1.5.0, the sqliteDeleteRecord function in Netmaker's database layer constructs SQL DELETE statements using direct string concatenation of user-supplied input. This allows an authenticated attacker to perform boolean-based SQL injection...

CVE-2026-32599

Netmaker (a WireGuard network manager) is vulnerable to boolean-based SQL injection in its SQLite database layer. Prior to version 1.5.0 , the sqliteDeleteRecord function builds SQL DELETE statements via direct string concatenation of user-supplied input from the DELETE /api/dns/{network}/{domain...

CVE-2026-32599 Netmaker has a boolean‑based SQL Injection

Netmaker makes networks with WireGuard. Prior to version 1.5.0, the sqliteDeleteRecord function in Netmaker's database layer constructs SQL DELETE statements using direct string concatenation of user-supplied input. This allows an authenticated attacker to perform boolean-based SQL injection...

CVE-2026-32599 Netmaker has a boolean‑based SQL Injection

Netmaker makes networks with WireGuard. Prior to version 1.5.0, the sqliteDeleteRecord function in Netmaker's database layer constructs SQL DELETE statements using direct string concatenation of user-supplied input. This allows an authenticated attacker to perform boolean-based SQL injection...

Netmaker has a boolean‑based SQL Injection

SQL Injection in Netmaker SQLite Database Backend Summary The sqliteDeleteRecord function in Netmaker's database layer constructs SQL DELETE statements using direct string concatenation of user-supplied input. This allows an authenticated attacker to perform boolean-based SQL injection. --- Detai...

discuz-ml-rce

discuz-ml-rce 影響を受けるシステムとバージョン：Discuz!ML V3.2-3.4 Discuz!x V3.2-3.4 脆弱性の原因：Discuz!ML システムはcookie内のlで受け取ったlanguageパラメータの内容をフィルタリングしないため、文字列が連結され、PHPコードが実行されます。 cookieフィールド内にxxxxxxxxlanguageフィールドが現れます。根本原因はこのフィールドにインジェクションが存在し、RCEを引き起こすことです。 パケットキャプチャでcookieのlanguageの値を見つけ、次の値に変更します...

CVE-2026-58201

Lokka is a Model Context Protocol server for Microsoft 365, including Microsoft Graph and other services. Prior to 2.1.2, the Lokka-Microsoft tool in src/mcp/src/main.ts uses direct URL string concatenation to append the user-controlled path value to the management.azure.com base URL. A specially...

CVE-2026-58201

Lokka (@merill/lokka), a Model Context Protocol server for Microsoft 365, is vulnerable to SSRF in versions prior to 2.1.2 . The root cause is in src/mcp/src/main.ts, where the tool constructs Azure Resource Manager request URLs via direct string concatenation with a user-controlled path value. A...

EUVD-2026-78934

Lokka is a Model Context Protocol server for Microsoft 365, including Microsoft Graph and other services. Prior to 2.1.2, the Lokka-Microsoft tool in src/mcp/src/main.ts uses direct URL string concatenation to append the user-controlled path value to the management.azure.com base URL. A specially...

net/mail: golang: net/mail: Denial of Service via pathological email address parsing

A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...

CVE-2026-46591

camel-neo4j Cypherインジェクション再現プログラム CVE-2026-46591 このプロジェクトは、CVE-2026-46591 として追跡されているApache Camelの camel-neo4j コンポーネントにおける Cypherインジェクション を実証します。プロデューサは、CamelNeo4jMatchProperties マップからマッチ/検索および削除操作のCypher WHERE 句を構築します。CVE-2025-66169 は、プロパティの 値 をクエリパラメータ $paramN としてバインドすることでインジェクションに対処しましたが、プロパティの...

CVE-2026-55416 Pimcore: SQL Injection in Mautic Custom Reports Bundle Due to Direct Concatenation of User-Controlled Configuration Fields Without Parameterization

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, an authenticated user with reportsconfig permission can place attacker-controlled SQL fragments in the sql, from, where, and groupby fields of a Custom Reports configuration processed by...

CVE-2026-28672

CVE-2026-28672 — Apache Ranger UnixUserGroupBuilder の OS コマンドインジェクション Apache Ranger の user-sync（unixusersync）モジュールにおける OS コマンドインジェクションの実行可能な PoC 再現コードです。 同期された各ユーザーのグループを列挙する際、UnixUserGroupBuilder はシェルを介して id コマンドを実行し、ユーザー名 をコマンドラインに連結します： root@kitploit: //...

pharmacy-sqli-CVE-2026-7392

Pharmacy Sales and Inventory System 1.0 - CVE-2026-7392 SQLインジェクション SourceCodester Pharmacy Sales and Inventory System V1.0 純粋なPHP/MySQL版 CVE : CVE-2026-7392 エンドポイント : /ajax.php?action=deletesupplier idパラメータ 種別 : SQLインジェクション CWE-89 CVSS 3.1 : 6.3 中 作者 : oretnom23 SourceCodester, 2020-10-08...

net/mail: golang: net/mail: Denial of Service via pathological email address parsing

A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...

CVE-2022-37209

CVE-2022-37209 POC CVE-2022-37209 POC 제안된 설명 JFinal CMS 5.1.0은 SQL 인젝션에 취약합니다. 이러한 인터페이스는 동일한 구성 요소를 사용하지 않으며 필터도 없지만, 각각 자체 SQL 결합 방식을 사용하여 SQL 인젝션이 발생합니다. 추가 정보 https://github.com/AgainstTheLight/someEXPofjfinalcms/blob/main/jfinalcms/sql5.md 취약점 유형 SQL 인젝션 제품 공급업체 개발 그룹 영향받는 제품 코드 베이스...

CVE-2022-37210

CVE-2022-37210 CVE-2022-37210 POC 제안된 설명 JFinal CMS 5.1.0은 SQL 삽입의 영향을 받습니다. 이 인터페이스들은 동일한 구성 요소를 사용하지 않으며 필터도 없지만, 각각 자체적인 SQL 연결 방식을 사용하여 SQL 삽입이 발생합니다. 추가 정보 https://github.com/AgainstTheLight/someEXPofjfinalcms/blob/main/jfinalcms/sql9.md 취약점 유형 SQL 삽입 제품 공급업체 개발 그룹 영향받는 제품 코드 베이스...