Joomla Easy Store - SQL Injection

Joomla Easy Store extension 1.0.0-2.0.1 contains an unauthenticated SQL injection caused by improper validation of order parameters, letting unauthenticated attackers read the full database including credentials and sessions. id: CVE-2026-65761 info: name: Joomla Easy Store - SQL Injection author...

CVE-2024-34472

CVE-2024-34472 Description: An authenticated user can abuse Blind SQL injection vulnerability exists in the mliRealtimeEmails.php file. The ordemGrid parameter in a POST request to /mailinspector/mliRealtimeEmails.php does not Properly sanitize input, allowing an authenticated attacker to execute...

CVE-2024-7928

CVE-2024-7928 POC for CVE-2024-7928. Will attempt to retrieve DB details for FastAdmin instances. How to Use FOFA : app="FASTADMIN" Install the script requirements: pip install -r requirements.txt Single Target: python CVE-2024-7928.py -u https://target:9090 Bulk Sscan: python CVE-2024-7928.py -f...

CVE-2024-7928

CVE-2024-7928 POC for CVE-2024-7928. Will attempt to retrieve DB details for FastAdmin instances. Overview This is a bulk scanning and exploitation tool for CVE-2024-7928: FastAdmin up to 1.3.3.20220121 allows unauthenticated attackers to execute a directory traversal. This tool is based on this...

CVE-2024-7928

CVE-2024-7928: FastAdmin V1.3.4.20220530 Arbitrary File Reading Vulnerability CVEHunter tool for vulnerability detection and exploit to retrieve DB details for FastAdmin instances for CVE-2024-7928 with accuracy and asynchronous concurrency than other poc's. Installation git clone...

EUVD-2026-118305

SQL injection vulnerability in the getlastseen code-server session-state RPC in Posit Software, PBC Posit Workbench before 2026.08.0 allows authenticated users to read arbitrary data from the Workbench database via the sessionIds parameter. NOTE: exploitation requires a valid authenticated sessio...

CVE-2026-121881: Posit Software, PBC Posit Workbench: SQL injection vulnerability in the get_last_seen code-server session-state RPC in Posit Software, PBC Posit Workbench…

SQL injection vulnerability in the getlastseen code-server session-state RPC in Posit Software, PBC Posit Workbench before 2026.08.0 allows authenticated users to read arbitrary data from the Workbench database via the sessionIds parameter. NOTE: exploitation requires a valid authenticated sessio...

CVE-2026-69145 SuiteCRM: AOR Reports aor_fields.field SQL Injection

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, AOR report generation reloads the value stored in aorfields.field and concatenates it into report SQL without strict field validation. An authenticated user able to...

CVE-2026-69145 SuiteCRM: AOR Reports aor_fields.field SQL Injection

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, AOR report generation reloads the value stored in aorfields.field and concatenates it into report SQL without strict field validation. An authenticated user able to...

OPENSUSE-SU-2026:22224-1 Security update for rqlite

This update for rqlite fixes the following issues: Changes in rqlite: - Update to version 10.6.6: Keep the local auto-backup file if the metadata rename fails Reject local auto-backup filenames reserved for internal use POST /demote and POST /promote return a JSON error body, and 404 when the...

CVE-2026-63160

Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the bearer credential held in the user's cookie. Attackers who gain access to the stored token, such as through database or...

CVE-2026-63160 Omnispace Agora Project < 26.10.0 Insecure Remember-Me Token Storage

Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the bearer credential held in the user's cookie. Attackers who gain access to the stored token, such as through database or...

CVE-2026-63160 Omnispace Agora Project < 26.10.0 Insecure Remember-Me Token Storage

Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the bearer credential held in the user's cookie. Attackers who gain access to the stored token, such as through database or...

CVE-2025-69295

CVE-2025-69295 — TeconceTheme Coven Core Blind SQL Injection Vulnerability CVE-2025-69295 is a SQL Injection vulnerability affecting the Coven Core component of the TeconceTheme Coven Core WordPress theme. The vulnerability exists due to improper neutralization of user-supplied input before it is...

CVE-2026-59971

MySQL MCP Server is a Model Context Protocol server that enables secure interaction with MySQL databases. Prior to 0.4.2, setting MCPTRANSPORT=sse causes src/mysqlmcpserver/server.py to construct SseServerTransport without securitysettings or enablednsrebindingprotection, while the Starlette rout...

CVE-2026-53603: Cleartext Storage of Sensitive Information

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, Operator session tokens are stored in plaintext in the operatorsessions table the token column is the PRIMARY KEY. The session token is a 32-byte random hex value sent directly in a cookie and valid for ...

PT-2026-70154

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools = label creator permission to execute arbitrary SQL via the image name field of a patron card layout. The image name value is stored verbatim in the layout XML...

PT-2026-69891

Name of the Vulnerable Software and Affected Versions Metabase affected versions not specified Description An authenticated attacker with low privileges can read the entire application database of the software. Recommendations At the moment, there is no information about a newer version that...

CVE-2026-12987

The Events Manager WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using No-User-Account Booking Mode: a booker-supplied registration field is stored as booking meta and later deserialized without restricting allowed classes, enabling PHP object injection...

EUVD-2026-41057

Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in media.php line 17: SELECT id, filename, extension, type, duration, owner, private FROM files where id = '".$GET'id'."'. An authenticated attacker can perform error-based SQL injection to extract...