cve-2021-22146

cve-2021-22146 Encontrei durante um pentest interno uma vulnerabilidade no elastic ECE. Elasticdump é um PoC para o CVE-2021-22146 para extrair o banco de dados do elastic ece das versões 7.10.0 a 7.13.3 https://www.exploit-db.com/exploits/50152 Colaboradores: Mario Díaz Caldera...

CVE-2026-81675

The endpoint ‘/ws/apiprensa/getVideoUltimasSeccion’ contains an SQL injection vulnerability in the idseccion parameter. The parameter is directly embedded in a complex SQL query that includes grouping and sorting operations. By injecting SQL syntax, an attacker can disrupt the query structure and...

EUVD-2026-67011

The endpoint ‘/ws/apiprensa/getVideoUltimasSeccion’ contains an SQL injection vulnerability in the idseccion parameter. The parameter is directly embedded in a complex SQL query that includes grouping and sorting operations. By injecting SQL syntax, an attacker can disrupt the query structure and...

CVE-2026-81675 Multiple Vulnerabilities in TOOOLS' iSquad

The endpoint ‘/ws/apiprensa/getVideoUltimasSeccion’ contains an SQL injection vulnerability in the idseccion parameter. The parameter is directly embedded in a complex SQL query that includes grouping and sorting operations. By injecting SQL syntax, an attacker can disrupt the query structure and...

CVE-2026-81675

CVE-2026-81675 is an SQL injection vulnerability in TOOOLS' iSquad , specifically in the endpoint /ws/apiprensa/getVideoUltimasSeccion via the id_seccion parameter. The parameter is directly embedded in a complex SQL query involving grouping and sorting operations, allowing an attacker to disrupt...

EUVD-2026-67010

The endpoint ‘/ws/apiprensa/getVideoNextPrev’ is vulnerable to SQL injection via the idambito parameter. Unsanitized input is directly incorporated into a MariaDB query, allowing attackers to inject SQL syntax that interrupts the query's execution. The vulnerability results in detailed database...

CVE-2026-72898-metabase-sqli

CVE-2026-72898 — Injeção SQL não autenticada no Metabase detector + análise -black Injeção SQL não autenticada no Metabase via POST /api/session/resetpassword. CVSS 10.0 , no catálogo CISA KEV, explorada ativamente. Um campo não declarado no corpo da solicitação de redefinição de senha chega à...

chrome-vuln-scanner

Scanner di Vulnerabilità di Chrome Uno strumento difensivo leggero e senza dipendenze che verifica la versione di Google Chrome installata rispetto a vulnerabilità note e genera un report HTML visivo di facile comprensione. Uno strumento difensivo leggero per verificare la versione di Google Chro...

CVE-2026-78260

An unauthenticated SQL injection vulnerability was identified in the WordPress plugin Epayco (Epayco Gateway) in versions 8.4.6 and earlier . The flaw was discovered by Lee Chul Woong and is rated CVSS 9.3 (Critical) with a changed scope, high confidentiality impact, and low availability impact. ...

CVE-2026-78260 WordPress Epayco plugin <= 8.4.6 - SQL Injection vulnerability

Unauthenticated SQL Injection in Epayco = 8.4.6 versions...

adminer_CVE-2021-43008

CVE-2021-43008 — Adminer-Sicherheitslücke Beliebiges Dateilesen mittels bösartigem MySQL-Server 1. Was ist Adminer? Adminer ist ein Web-Tool PHP zur einfachen Verwaltung von MySQL-, PostgreSQL-, SQLite- oder SQL-Server-Datenbanken. Es wird häufig als leichte Alternative zu phpMyAdmin eingesetzt...

go-dbmigrate

migrate Un helper per le migrazioni scritto in Go. Usalo nel tuo codice Golang esistente oppure esegui i comandi tramite la CLI. root@kitploit: GoCode import github.com/mattes/migrate/migrate CLI go get -u github.com/mattes/migrate Caratteristiche Estremamente semplice da implementare con...

CVE-2026-37749

CVE-2026-37749 — CodeAstro Simple Attendance Management System 1.0 - SQL-Injection Details...

CVE-2021-21311

CVE-2021-21311 Adminer è un sistema open-source di gestione di database in un singolo file PHP. In Adminer dalla versione 4.0.0 e precedenti alla 4.7.9 esiste una vulnerabilità di server-side request forgery. Gli utenti delle versioni di Adminer che includono tutti i driver ad es. adminer.php son...

CVE-2021-2175

Proof of Concept è pubblicato qui: https://databasesecurityninja.wordpress.com/2022/02/02/cve-2021-2175-database-vault-metadata-exposure-vulnerability/...

CVE-2026-32321

CVE-2026-32321 CVE-2026-32321 | Clipbucket Blind SQL Injection...

ghost-cve-2026-26980

CVE-2026-26980 — Lab di SQL Injection nella Content API di Ghost CMS SQL injection blind non autenticata in Ghost CMS tramite il meccanismo di ordinamento del filtro slug della Content API, che consente letture arbitrarie del database da qualsiasi istanza Ghost senza credenziali...

CVE-2026-7229-SQLI

SQL Injection autenticata nel Coaching Management System consente il dump del database Descrizione Esiste una vulnerabilità di SQL Injection nel Coaching Management System in PHP. Il parametro complaintreply nella funzionalità di risposta dell'amministratore non viene adeguatamente sanificato pri...

CVE-2025-58443

CVE-2025-58443 Exploit POC für https://github.com/FOGProject/fogproject, welches einen Authentifizierungs-Bypass darstellt, der zu einem vollständigen DB-Dump führt, der Klartext-Passwörter und Benutzer- sowie Admin-Passwort-Hashes enthält. Anfällige Version : 1.5.10.1673 Nachfolgend ein Skript,...

DBScanner

DBScanner Detecção em lote de acesso não autorizado + senhas fracas Script de varredura automática de bancos de dados SQL e No-SQL comuns em redes internas mysql, mssql, oracle, postgresql, redis, mongodb, memcached, elasticsearch, incluindo detecção de acesso não autorizado e senhas fracas comun...