39 matches found
CVE-2026-57517
Control Web Panel ≤ 0.9.8.1224 — 盲注 SQL 注入至远程代码执行 端口 2083 → userRes POST → INTO DUMPFILE → 端口 2031 WebShell → cwpsvc 🔴 漏洞概述 CVE-2026-57517 是 Control Web Panel CWP 版本 ≤ 0.9.8.1224 中存在的一个严重的未认证盲注 SQL 注入漏洞。用户面板端点的 userRes POST 参数在被拼接到 SQL 查询之前未经过滤。查询以 MySQL root 权限执行——该权限拥有全局 FILE 权限——从而允许攻击者通过 INTO...
AlmaLinux 9.6 [TuxCare] Security Update: mariadb / mariadb-backup / mariadb-common / mariadb-devel / etc (ALMALINUX9.6:CLSA-2026:1784045832)
The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784045832 advisory. - MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to...
AlmaLinux 9.2 [TuxCare] Security Update: mariadb / mariadb-backup / mariadb-common / mariadb-devel / etc (ALMALINUX9.2:CLSA-2026:1783515814)
The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1783515814 advisory. - MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to...
Rocky Linux 9.6 [TuxCare] Security Update: mariadb / mariadb-backup / mariadb-common / mariadb-devel / etc (ALMALINUX9.6:CLSA-2026:1784045832)
The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784045832 advisory. - MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 ...
Linux Distros Unpatched Vulnerability : CVE-2026-100695
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTIONID database result is interpolated into JavaScript without proper escapin...
DEBIAN-CVE-2026-100695
Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTIONID database result is interpolated into JavaScript without proper escaping, allowing a malicious database server to execute arbitrary JavaScript in the authenticated Adminer origin. In co-located deployments...
CVE-2026-100695
Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTIONID database result is interpolated into JavaScript without proper escaping, allowing a malicious database server to execute arbitrary JavaScript in the authenticated Adminer origin. In co-located deployments...
CVE-2026-100695
Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTIONID database result is interpolated into JavaScript without proper escaping, allowing a malicious database server to execute arbitrary JavaScript in the authenticated Adminer origin. In co-located deployments...
UBUNTU-CVE-2026-100695
Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTIONID database result is interpolated into JavaScript without proper escaping, allowing a malicious database server to execute arbitrary JavaScript in the authenticated Adminer origin. In co-located deployments...
CVE-2026-100695 Adminer before 6.0.2 XSS via CONNECTION_ID escalating to RCE
Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTIONID database result is interpolated into JavaScript without proper escaping, allowing a malicious database server to execute arbitrary JavaScript in the authenticated Adminer origin. In co-located deployments...
CVE-2026-100695 Adminer before 6.0.2 XSS via CONNECTION_ID escalating to RCE
Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTIONID database result is interpolated into JavaScript without proper escaping, allowing a malicious database server to execute arbitrary JavaScript in the authenticated Adminer origin. In co-located deployments...
CVE-2026-100695 Adminer before 6.0.2 XSS via CONNECTION_ID escalating to RCE
Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTIONID database result is interpolated into JavaScript without proper escaping, allowing a malicious database server to execute arbitrary JavaScript in the authenticated Adminer origin. In co-located deployments...
CVE-2026-100695
Adminer before version 6.0.2 is vulnerable to a cross-site scripting (XSS) flaw because the CONNECTION_ID() database result is interpolated into JavaScript without proper escaping. This allows a malicious database server to execute arbitrary JavaScript within the authenticated Adminer origin. In ...
EUVD-2026-87668
Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTIONID database result is interpolated into JavaScript without proper escaping, allowing a malicious database server to execute arbitrary JavaScript in the authenticated Adminer origin. In co-located deployments...
CVE-2026-100695
Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTIONID database result is interpolated into JavaScript without proper escaping, allowing a malicious database server to execute arbitrary JavaScript in the authenticated Adminer origin. In co-located deployments...
CVE-2026-100695: Improper Neutralization of Input During Web Page Generation
Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTIONID database result is interpolated into JavaScript without proper escaping, allowing a malicious database server to execute arbitrary JavaScript in the authenticated Adminer origin. In co-located deployments...
Exploit for SQL Injection in Zoneminder
ZoneMinder 1.29/1.30 SQLi to RCE Exploit A ready-to-run Pytho...
CVE-2026-57517
Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthenticated remote attackers to execute arbitrary SQL queries by submitting unsanitized input through the userRes POST parameter at the user endpoint. Attackers can exploit MySQL root privileges...
EUVD-2026-41027
Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthenticated remote attackers to execute arbitrary SQL queries by submitting unsanitized input through the userRes POST parameter at the user endpoint. Attackers can exploit MySQL root privileges...
CVE-2026-57517
Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthenticated remote attackers to execute arbitrary SQL queries by submitting unsanitized input through the userRes POST parameter at the user endpoint. Attackers can exploit MySQL root privileges...