kitsune

🦊 kitsune | |/ / | \ | | | | ' / |...

CVE-2024-55099-Online-Nurse-Hiring-System-v1.0-SQL-Injection-Vulnerability-

CVE-2024-55099-Online-Nurse-Hiring-System-v1.0-SQL-Injection-Vulnerability Exploit Author: ugurkarakoc Vendor Homepage https://phpgurukul.com/online-nurse-hiring-system-using-php-and-mysql Software Link https://phpgurukul.com/?sdmprocessdownload=1&downloadid=17826 Overview...

Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch

Threat actors are beginning to probe for a newly patched critical vulnerability in Oracle E-Business Suite EBS, according to threat intelligence firm Defused Cyber. The vulnerability in question is CVE-2026-101767 CVSS score: 9.8 , a case of improper authentication in the Oracle Application Objec...

CVE-2026-115223

The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being stored in a popup text block and later evaluated by its template engine, because the filter meant to strip template delimiters runs before a decoding step that reconstructs them,...

EUVD-2026-111973

The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being stored in a popup text block and later evaluated by its template engine, because the filter meant to strip template delimiters runs before a decoding step that reconstructs them,...

CVE-2026-115223 Smart Popup by Supsystic < 2.0.2 - Admin+ SSTI via Popup Text Block

The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being stored in a popup text block and later evaluated by its template engine, because the filter meant to strip template delimiters runs before a decoding step that reconstructs them,...

CVE-2026-14571

A Blind SQL Injection vulnerability in Futurum Software’s management software, caused by a lack of adequate validation and sanitisation of user-provided inputs in queries to the private area’s database, as well as by an incorrect WAF configuration. This weakness allows the protection mechanisms t...

CVE-2026-14571 SQL injection (SQLi) in the user authentication module of Futurum Software

A Blind SQL Injection vulnerability in Futurum Software’s management software, caused by a lack of adequate validation and sanitisation of user-provided inputs in queries to the private area’s database, as well as by an incorrect WAF configuration. This weakness allows the protection mechanisms t...

CVE-2026-14571

A Blind SQL Injection vulnerability exists in the user authentication module of Futurum Software’s management software . The root cause is a combination of insufficient validation and sanitization of user-provided inputs in queries to the private area's database, exacerbated by an incorrect WAF c...

EUVD-2026-111845

A Blind SQL Injection vulnerability in Futurum Software’s management software, caused by a lack of adequate validation and sanitisation of user-provided inputs in queries to the private area’s database, as well as by an incorrect WAF configuration. This weakness allows the protection mechanisms t...

CVE-2026-76005

The WP Inventory Manager plugin for WordPress is vulnerable to time-based SQL Injection via 'sortorder' Shortcode Attribute in all versions up to, and including, 2.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2026-63286

Database backups are vulnerable to offline attacks. Backups created using a version prior to the patched version are still vulnerable. AXIS Camera Station Pro automatically creates one more such backup for recovery purpose when the update is applied. Delete all these backups and change the...

CVE-2026-116609

The WP Visitor Statistics Real Time Traffic plugin for WordPress is vulnerable to SQL Injection via the 'from' and sibling 'to'/'first'/'second' shortcode attribute of the wsmshowTrafficStatsList shortcode in versions up to, and including, 8.8 This is due to insufficient escaping on the...

CVE-2026-63286

Database backups are vulnerable to offline attacks. Backups created using a version prior to the patched version are still vulnerable. AXIS Camera Station Pro automatically creates one more such backup for recovery purpose when the update is applied. Delete all these backups and change the...

CVE-2026-63286

The AXIS Camera Station Pro software is impacted by a vulnerability where database backups are susceptible to offline attacks . This occurs because backups created on versions prior to the patch remain vulnerable. When an update is applied, the system automatically generates one additional backup...

EUVD-2026-111816

Database backups are vulnerable to offline attacks. Backups created using a version prior to the patched version are still vulnerable. AXIS Camera Station Pro automatically creates one more such backup for recovery purpose when the update is applied. Delete all these backups and change the...

CVE-2025-46171

vBulletin 3.x.x - DoS via Buddy List Overload Summary The /misc.php?do=buddylist endpoint runs a single, large JOIN query that retrieves all buddies along with their user and session information to check online status. Because this query processes the entire buddy list without pagination or resul...

CVE-2026-76005 WP Inventory Manager <= 2.5.5 - Authenticated (Contributor+) SQL Injection via 'sort_order' Shortcode Attribute

The WP Inventory Manager plugin for WordPress is vulnerable to time-based SQL Injection via 'sortorder' Shortcode Attribute in all versions up to, and including, 2.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2026-76005

The WP Inventory Manager plugin for WordPress (all versions up to and including 2.5.5 ) is vulnerable to a time-based SQL Injection via the 'sort_order' shortcode attribute. The root cause is insufficient escaping of user-supplied parameters and a lack of sufficient preparation on existing SQL qu...

CVE-2026-76005 WP Inventory Manager <= 2.5.5 - Authenticated (Contributor+) SQL Injection via 'sort_order' Shortcode Attribute

The WP Inventory Manager plugin for WordPress is vulnerable to time-based SQL Injection via 'sortorder' Shortcode Attribute in all versions up to, and including, 2.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...