CVE-2026-105469

A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This vulnerability affects unknown code of the file gettown.php of the component AJAX Endpoint. Executing a manipulation of the argument countryid/townid/cid/didval/cidv...

CVE-2026-105470

A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This issue affects the function mysqliquery of the file locateus.php of the component Doctor Search Endpoint. The manipulation of the argument doctorname leads to sql...

CVE-2025-29529

SQLi ITC Multiplan CVE-2025-29529 发现 2025年2月21日，在一次客户参与中，发现ITC Systems开发的“Multiplan”平台存在SQL注入漏洞。 受影响版本 该漏洞仅在v3.7.4.1002版本上进行了测试 攻击向量 由“ForgotPassword.aspx”端点使用的“ctl00%24cpLogin%24ctlForgotPassword%24txtEmail”POST参数被发现未经过滤。未认证的攻击者可以利用此漏洞读取应用程序的后端数据库。 POC 作为概念验证（PoC），收集了数据库信息，如表和列。 漏洞检测...

CVE-2022-22947

CVE-2022-22947 对 Spring Cloud Gateway 的代码注入攻击 CVE 摘要 在 3.1.1+ 和 3.0.7+ 之前的 Spring Cloud Gateway 版本中，当 Gateway Actuator 端点启用、暴露且未受保护时，应用程序容易受到代码注入攻击。远程攻击者可以发出恶意构造的请求，从而在远程主机上执行任意远程代码。 受影响版本 Oracle Communications Cloud Native Core Network Function Cloud Native Environment 1.10.0 Oracle Communicatio...

CVE-2026-105470 girishsaraf Online-Appointment-Booking-System Doctor Search Endpoint locateus.php mysqli_query sql injection

A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This issue affects the function mysqliquery of the file locateus.php of the component Doctor Search Endpoint. The manipulation of the argument doctorname leads to sql...

CVE-2026-105470

The girishsaraf Online-Appointment-Booking-System (up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5 ) is vulnerable to a SQL injection in the Doctor Search Endpoint component. The flaw exists within the mysqli_query function of the locateus.php file, where improper handling of the doctorname...

CVE-2026-105469

The girishsaraf Online-Appointment-Booking-System contains a SQL injection vulnerability within the AJAX Endpoint component, specifically affecting the get_town.php file. The flaw is triggered by manipulating the countryid , townid , cid , didval , or cidval arguments. This vulnerability can be e...

CVE-2026-105469 girishsaraf Online-Appointment-Booking-System AJAX Endpoint get_town.php sql injection

A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This vulnerability affects unknown code of the file gettown.php of the component AJAX Endpoint. Executing a manipulation of the argument countryid/townid/cid/didval/cidv...

wp2shell-lab

wp2shell-lab PoC educativo y laboratorio para CVE-2026-63030 + CVE-2026-60137 : inyección SQL sin autenticación en el núcleo de WordPress mediante confusión de rutas batch REST. Descubierto por Adam Kues Searchlight Cyber / Assetnote. Corregido en WordPress 6.9.5 / 7.0.2. Inicio rápido bring up t...

CVE-2025-60357

CVE-2025-60357- NoSQLMongoDB注入 漏洞和产品描述 AhnLab EPP Management 是全球公认的下一代高级端点保护平台，集成了补丁管理、高级恶意软件检测、EDR 和 XDR 功能。 在 AhnLab EPP Management v1.0.14.32-6249 的端点 /api/console/ems/eventlog/agentEvent/list 中发现了 NoSQLMongoDB注入 ，导致敏感信息和 PII 泄露。该受影响端点现已修补，AhnLab 于 2024 年 8 月发布了补丁版本（P14.32 P16.25）。 Exploit...

CVE-2026-46453

Reproducción de inyección de encabezado sin prefijo camel-elasticsearch-rest-client CVE-2026-46453 Este proyecto demuestra una inyección de encabezados de mensaje / omisión de autorización en el componente camel-elasticsearch-rest-client de Apache Camel, registrada como CVE-2026-46453. El...

CVE-2026-38526-PoC

CVE-2026-38526 | Krayin CRM v2.2.x 认证后远程代码执行 - 通过 TinyMCE 未限制 PHP 文件上传 描述 CVE-2026-38526 是一个影响 Webkul Krayin CRM v2.2.x 的关键认证后远程代码执行漏洞。该漏洞存在于 TinyMCE 媒体上传端点 /admin/tinymce/upload，该端点未能验证上传的文件类型。经过身份验证的攻击者可以上传恶意 PHP 文件并在服务器上执行任意命令。 CVE： CVE-2026-38526 CVSS 评分： 9.9（严重） CWE： CWE-434 - 未限制危险类型文件上传...

CVE-2023-43208

CVE-2023-43208 — Mirth Connect 预认证远程代码执行 在 NextGen Healthcare Mirth Connect CVSS 9.8（严重） — CVE-2023-37679 的补丁绕过 概述 Mirth Connect 在 /api/users 端点上使用 Java XStream 库反序列化 XML 负载，无需身份验证 。原始修复（CVE-2023-37679）引入了一个危险类黑名单，但通过使用 Apache Commons Lang3 中的 EventBindingInvocationHandler 结合 Commons Collections4...

CVE-2026-105388

A weakness has been identified in feelec-yishu feelcrm-os 1.0.0. This vulnerability affects the function index of the file App/Feelcrm/Index/Controller/MemberController.class.php of the component Member Endpoint. This manipulation of the argument groupid causes sql injection. The attack can be...

CVE-2026-105389

A security vulnerability has been detected in feelec-yishu feelcrm-os 1.0.0. This issue affects some unknown processing of the file App/Feelcrm/Crm/Controller/UploadController.class.php of the component UploadTicketFile Endpoint. Such manipulation of the argument cmd leads to unrestricted upload...

CVE-2026-57821-PoC-Exploit

🛡️ CVE-2026-57821 – Inyección SQL en Apache Fineract ⚠️ AVISO LEGAL Y ÉTICO Este toolkit se proporciona estrictamente para fines educativos, de formación y de pruebas de seguridad autorizadas. El uso no autorizado contra cualquier sistema sin permiso escrito explícito es ilegal y viola las leyes de...

CVE-2026-105389 feelec-yishu feelcrm-os UploadTicketFile Endpoint UploadController.class.php unrestricted upload

A security vulnerability has been detected in feelec-yishu feelcrm-os 1.0.0. This issue affects some unknown processing of the file App/Feelcrm/Crm/Controller/UploadController.class.php of the component UploadTicketFile Endpoint. Such manipulation of the argument cmd leads to unrestricted upload...

CVE-2026-105389

The feelec-yishu feelcrm-os version 1.0.0 is vulnerable to an unrestricted upload vulnerability within the UploadTicketFile Endpoint . The issue stems from unknown processing in the file App/Feelcrm/Crm/Controller/UploadController.class.php , where manipulation of the cmd argument allows for remo...

EUVD-2026-92774

A security vulnerability has been detected in feelec-yishu feelcrm-os 1.0.0. This issue affects some unknown processing of the file App/Feelcrm/Crm/Controller/UploadController.class.php of the component UploadTicketFile Endpoint. Such manipulation of the argument cmd leads to unrestricted upload...

CVE-2023-45878

Exploit de Gibbon CMS CVE-2023-45878 Este script de Python explota CVE-2023-45878, una vulnerabilidad de carga arbitraria de archivos sin autenticación en Gibbon CMS versiones 25.0.1 y anteriores, que permite la Ejecución Remota de Código RCE. Descripción de la vulnerabilidad CVE-2023-45878 exist...