CVE-2026-118871

SQL injection vulnerability classified as an internal threat level.Attackers can steal database information via SQL injection while logged in...

EUVD-2026-115116

The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the structure of SQL statements. A user with administrator privileges can exploit this by influencing the structure of executed SQL statements, enabling blind SQL injection to infer...

CVE-2026-2613 SQL Injection via Admin REST API in Multiple WSO2 Products Allows Database Information Inference and Service Disruption

The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the structure of SQL statements. A user with administrator privileges can exploit this by influencing the structure of executed SQL statements, enabling blind SQL injection to infer...

CVE-2026-2613

Multiple WSO2 products are affected by a blind SQL injection vulnerability in the Admin REST API . The root cause is the lack of adequate sanitization for user-supplied input, which allows it to be included in the structure of SQL statements. An attacker with administrator privileges can exploit ...

CVE-2026-2613 SQL Injection via Admin REST API in Multiple WSO2 Products Allows Database Information Inference and Service Disruption

The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the structure of SQL statements. A user with administrator privileges can exploit this by influencing the structure of executed SQL statements, enabling blind SQL injection to infer...

CVE-2026-118871 SQL Injection vulnerability in ZTE ElasticNet RNIA R18 NGI product

SQL injection vulnerability classified as an internal threat level.Attackers can steal database information via SQL injection while logged in...

EUVD-2026-115113

SQL injection vulnerability classified as an internal threat level.Attackers can steal database information via SQL injection while logged in...

CVE-2026-118871 SQL Injection vulnerability in ZTE ElasticNet RNIA R18 NGI product

SQL injection vulnerability classified as an internal threat level.Attackers can steal database information via SQL injection while logged in...

CVE-2026-118871

A SQL injection vulnerability exists in the ZTE ElasticNet RNIA R18 NGI product. This internal threat level vulnerability allows authenticated attackers to steal database information while logged into the system. Technical details regarding the specific affected component or root cause are not pr...

PT-2026-135402

The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the structure of SQL statements. A user with administrator privileges can exploit this by influencing the structure of executed SQL statements, enabling blind SQL injection to infer...

PT-2026-135393

SQL injection vulnerability classified as an internal threat level.Attackers can steal database information via SQL injection while logged in...

CVE-2026-118871: ZTE ElasticNet RNIA R18 NGI: SQL injection vulnerability classified as an internal threat level.Attackers can steal database information via SQL…

SQL injection vulnerability classified as an internal threat level.Attackers can steal database information via SQL injection while logged in...

CVE-2026-120444: sea-team GoFound: GoFound through 1.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to delete arbitrary…

GoFound through 1.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to delete arbitrary directories by supplying ../ sequences in the database parameter. Attackers can send GET requests to /api/db/create and /api/db/drop, directly or via a victim's browser,...

PT-2026-135478

LaraDashboard before 1.4.5 contains an incorrect authorization vulnerability in SettingPolicy::manageCoreUpgrades that allows non-Superadmin administrators with settings.edit to access Superadmin-only core-upgrade operations. Attackers can use the /admin/settings/core-upgrades backup, download,...

CVE-2026-120487: LaraDashboard: LaraDashboard before 1.4.5 contains an incorrect authorization vulnerability in SettingPolicy::manageCoreUpgrades()…

LaraDashboard before 1.4.5 contains an incorrect authorization vulnerability in SettingPolicy::manageCoreUpgrades that allows non-Superadmin administrators with settings.edit to access Superadmin-only core-upgrade operations. Attackers can use the /admin/settings/core-upgrades backup, download,...

CVE-2026-2613: WSO2: The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the…

The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the structure of SQL statements. A user with administrator privileges can exploit this by influencing the structure of executed SQL statements, enabling blind SQL injection to infer...

PT-2026-135460

GoFound through 1.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to delete arbitrary directories by supplying ../ sequences in the database parameter. Attackers can send GET requests to /api/db/create and /api/db/drop, directly or via a victim's browser,...

CVE-2026-119562

phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped colextra and colattribute values to /database/central-columns. Attackers can inject SQL into pmacentralcolumns INSERT and UPDATE queries run with controluser...

CVE-2026-119561

phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse that never verifies WebAuthn assertion signatures against stored public keys. Attackers holding a victim's MySQL credentials can POST a crafted webauthnrequestresponse with...

grafanaExp

grafanaExp Exploit Grafana CVE-2021-43798 arbitrary file read vulnerability to automatically detect vulnerability, existing plugins, extract secret key, decrypt server database file, and output datasourrce info. Usage Provides exp and decode functionality. ➜ ./grafanaExp -h NAME: grafanaExp -...