CVE-2020-7471

CVE-2020-7471 This repository provides the environment and POC for CVE-2020-7471 Potential SQL injection via StringAggdelimiter vulnerability. Affected Django versions 1.11 to 1.11.28 exclusive 2.2 to 2.2.10 exclusive 3.0 to 3.0.3 exclusive Before downloading and using, the following operations a...

CVE-2020-7471-Django

CVE-2020-7471-PoC Django PoC for the SQL injection vulnerability in PostgreSQL with Django, found in Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 The class django.contrib.postgres.aggregates.StringAgg for using the PostgreSQL STRINGAGG function had a SQL injection...

CVE-2026-3854-PoC

CVE-2026-3854 PoC — X-Stat 푸시 옵션 주입을 통한 GitHub RCE 교육 및 인가된 보안 연구 목적으로만 사용하십시오. 명시적인 서면 허가 없이 어떤 시스템에도 사용하지 마십시오. 개요 CVE-2026-3854 는 GitHub Enterprise Server및 GitHub.com의 git push 파이프라인에서 발생하는 원격 코드 실행RCE 취약점입니다. 클라이언트가 푸시 옵션git push -o을 제공하면 GitHub의 내부 Ruby 코드는 각 옵션 값을 세미콜론으로 연결하여 X-Stat 헤더를...

CVE-2020-7471

CVE-2020-7471 This repository provides the environment and POC for CVE-2020-7471 Potential SQL injection via StringAggdelimiter vulnerability. Affected Django versions 1.11 to 1.11.28 exclusive 2.2 to 2.2.10 exclusive 3.0 to 3.0.3 exclusive The following steps are required before downloading and...

cve-collector

CVE-Collector Simple Latest CVE Collector Written in Python There are various methods for collecting the latest CVE Common Vulnerabilities and Exposures information. This code was created to provide guidance on how to collect, what information to include, and how to code when creating a CVE...

CVE-2025-46819

CVE-2025-46819 – Redis Lua 長文字列デリミタの範囲外読み取り 不正な長文字列デリミタにより、Redis 8.2.1 の Lua レキサーで範囲外読み取り（OOB read）が発生します。 概要 Redis 8.2.1 の Lua 長文字列パーサーは、不正な =... シーケンスを誤って処理し、バッファアンダーフローや過剰な再帰を引き起こすセンチネル値を返します。攻撃者はこれにより、Redis に範囲外読み取りを発生させたり、C スタックをオーバーフローさせたりすることができます。 環境 Redis サーバー 8.2.1（または 8.2.2...

CVE-2026-103505

Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver aws-efs-csi-driver v3.1.0 through v3.4.2 might allow remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma-separated values in the...

DjVul_StringAgg

Django CVE-2020-7471 SQLi CVE-2020-7471: Potential SQL injection via StringAggdelimiter django.contrib.postgres.aggregates.StringAgg aggregation function was subject to SQL injection, using a suitably crafted delimiter. RUN python manage.py makemigrations python manage.py migrate python manage.py...

Security Bulletin: IBM Maximo Manage application in IBM Maximo Application Suite is vulnerable to multiple vulnerabilities

Summary IBM Maximo Manage application in IBM Maximo Application Suite uses uses httpcore5-h2-5.2.4.jar, browserslist-4.23.0.tgz, baseline-browser-mapping-2.10.13.tgz, fast-uri-3.1.5.tgz and fast-uri-3.1.6.tgz and is vulnerable to CVE-2026-54428, CVE-2026-54399, CVE-2026-73088, CVE-2026-45819,...

PT-2026-103904

Name of the Vulnerable Software and Affected Versions AWS EFS CSI Driver aws-efs-csi-driver versions 3.1.0 through 3.4.2 Description Improper neutralization of argument delimiters in the volume handling component allows remote authenticated users with PersistentVolume creation permissions to inje...

CVE-2020-7471

CVE-2020-7471 StringAgg 구분자 입력을 통한 SQL 인젝션 설정: 초기 설정을 위해 ./setup.sh 실행 데이터베이스를 시작하려면 도커 이미지를 열어라: docker exec -it containerid /bin/bash 그리고 다음 명령어를 실행하라: python manage.py makemigrations vulapp python manage.py migrate 다음을 사용하여 인스턴스를 시작하라: docker-compose up 이제 다음 URL을 열어 샘플 데이터를 로드하라:...

EUVD-2026-70280

fast-uri vulnerable to authority injection via an unvalidated port in serialize...

CVE-2026-96748 Connection redirection via percent-encoded delimiter injection in connection string hosts

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of the...

CVE-2026-96748 Connection redirection via percent-encoded delimiter injection in connection string hosts

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of the...

CVE-2026-96748

The PyMongo database driver is vulnerable to connection redirection due to percent-encoded delimiter injection in connection string hosts. The root cause is that PyMongo decodes percent-encoded characters in the host portion before separating the host list by delimiters. If an application include...

CVE-2026-96748 Connection redirection via percent-encoded delimiter injection in connection string hosts

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of the...

Connection redirection via percent-encoded delimiter injection in connection string hosts

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of the...

CVE-2026-71464: Improper Neutralization of Argument Delimiters in a Command

LaunchConfigurationBaseSerializer.scmbranch has no validatescmbranch leading-dash check, unlike Project/JobTemplate/JobLaunch serializers. Schedule and WFJT Node accept --upload-pack=/bin/id as scmbranch. Currently blocked at runtime by jobs.py:1502 ValueError check defense-in-depth, but the API...

Linux Distros Unpatched Vulnerability : CVE-2026-77404

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, URI.String in uri.go concatenates CertFile, KeyFile, CACertFile, and ServerName values directly...

CVE-2026-55061: Improper Neutralization of Argument Delimiters in a Command

uniget is a universal installer and updater for container tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go parses UNIGETEDITOR or EDITOR with strings.Spliteditor, " " and passes every space-delimited suffix as an argument to the selected editor executable. An attacker who can...