4540 matches found
EUVD-2026-72851
A SQL injection vulnerability in the apformid parameter in AppNitro MachForm v30 allows attackers to access sensitive database information via a crafted SQL statement...
CVE-2026-79570
mfish-nocode-pro v1.0.0 was discovered to contain a SQL injection vulnerability in the tableName parameter at /sys/dbConnect/data. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...
CVE-2026-79569
The Movie_Recommend v1.0.0 software is vulnerable to a SQL injection flaw within the sort parameter at the /loadingmore endpoint. This vulnerability exists because of improper neutralization of special elements used in an SQL command, which allows an attacker to execute a crafted SQL statement to...
CVE-2026-79569: Improper Neutralization of Special Elements used in an SQL Command
MovieRecommend v1.0.0 was discovered to contain a SQL injection vulnerability in the sort parameter at /loadingmore. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...
EUVD-2026-72959
MovieRecommend v1.0.0 was discovered to contain a SQL injection vulnerability in the sort parameter at /loadingmore. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...
EUVD-2026-72909
L-ONE v1.0.0 was discovered to contain multiple SQL injection vulnerabilities in the /attachment/getBusinessUploadList component via the busid, id, and taskid parameters. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...
CVE-2026-79573
L-ONE v1.0.0 was discovered to contain multiple SQL injection vulnerabilities in the /attachment/getBusinessUploadList component via the busid, id, and taskid parameters. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...
PT-2026-87144
mfish-nocode-pro v1.0.0 was discovered to contain a SQL injection vulnerability in the tableName parameter at /sys/dbConnect/data. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...
CVE-2026-79570
mfish-nocode-pro v1.0.0 was discovered to contain a SQL injection vulnerability in the tableName parameter at /sys/dbConnect/data. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...
CVE-2026-78837
AppNitro MachForm v30 is vulnerable to a remote SQL injection vulnerability within the ap_form_{id} parameter. An unauthenticated attacker can exploit the filter[filters][0][field] parameter in grid_datasource.php to execute crafted SQL statements. This flaw allows for the enumeration of valid co...
EUVD-2026-71862
The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append arbitrary SQL and read the contents of the database, including user credentials...
CVE-2026-53603 nebula-mesh: Operator session tokens stored in plaintext in the database
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, Operator session tokens are stored in plaintext in the operatorsessions table the token column is the PRIMARY KEY. The session token is a 32-byte random hex value sent directly in a cookie and valid for ...
EUVD-2026-70982
DreamMaker developed by Interinfo has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database contents...
CVE-2026-85540 Interinfo｜DreamMaker - SQL Injection
DreamMaker developed by Interinfo has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database contents...
PT-2026-85453
DreamMaker developed by Interinfo has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database contents...
CVE-2018-18964
creationtimestamp| type| source ---|---|--- 2026-09-01 20:02:12+00:00| seen| https://t.me/hackingAttack/29057 2026-09-01 20:02:15+00:00| seen| https://t.me/hackingAttack/27123 2026-09-01 20:02:17+00:00| seen| https://t.me/hackingAttack/27117 2026-09-01 20:02:17+00:00| seen|...
CVE-2026-65642
A flaw was found in Plesk. This vulnerability, known as an Insecure Direct Object Reference IDOR, allows remote authenticated users to bypass authorization checks. An attacker can exploit this to read and modify other customers' databases, leading to unauthorized information disclosure and data...
CVE-2026-74820: Improper Neutralization of Special Elements used in an SQL Command
ServiceNow has remediated a SQL injection vulnerability that was identified in in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gain access to, or...
