CVE-2024-51482

CVE-2024-51482 — ZoneMinder 시간 기반 블라인드 SQL 인젝션 CVE-2024-51482 에 대한 개념 증명 익스플로잇입니다. ZoneMinder v1.37. ≤ 1.37.64에서 발견된 인증된 시간 기반 블라인드 SQL 인젝션 취약점입니다. 이 스크립트는 SLEEP 기반 오라클을 통해 이진 검색이분법을 사용하여 zm.Users 테이블에서 사용자 이름과 비밀번호 해시를 추출합니다. 취약점 web/ajax/event.php의 removetag 핸들러는 DELETE 쿼리를 안전하게 매개변수화하지만 이후...

CVE-2026-102607-ZoneMinder

セキュリティ脆弱性レポート: ZoneMinder exportEvents における OS コマンドインジェクション 概要 ZoneMinder のイベントエクスポート機能に、認証済みユーザーが悪用可能な OS コマンドインジェクションの脆弱性が存在します。exportFile HTTP リクエストパラメータがサニタイズされずに PHP の exec を介して実行されるシェルコマンドに渡されるため、View Events 権限を持つ任意の認証済みユーザーがサーバー上で任意のオペレーティングシステムコマンドを実行できます。 この脆弱性により、Web サーバーユーザー www-data...

CVE-2024-51482

CVE-2024-51482 ZoneMinder v1.37. = 1.37.64 CVE-2024-51482 poc.py By default, this script enumerates the zm database, pulls from the Users table, and dumps Username+Password columns. If these 4 things exist, you will receive a username and password hash. More detailed information on the...

CVE-2024-51482-ZoneMinder-v1.37.-1.37.64-SQL-Injection-POC

ZoneMinder 시간 기반 SQL 인젝션 CVE-2024-51482 📌 취약점 개요 CVE ID: CVE-2024-51482 보안 권고: GHSA-qm8h-3xvf-m7j3 영향받는 버전: ZoneMinder 1.37. 1.37.64 1.37.64 포함 패치된 버전: 1.37.65 📖 설명 이 저장소는 ZoneMinder 1.37. 1.37.64에서 발견된 블라인드 SQL 인젝션 취약점에 대한 고성능 병렬 처리 PoCProof-of-Concept 익스플로잇Exploit.py을 포함합니다. 취약점 근본 원인 및 영향...

EUVD-2005-2882

Malware in sbrugna...

EUVD-2006-1890

Malware in sbrugna...

CVE-2025-8908: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.5.4. Affected by this issue is some unknown functionality of the file crm/WeiXinApp/yunzhijia/event.php. The manipulation of the argument openid leads to sql injection. The attack may be launched...

PT-2025-32987

Name of the Vulnerable Software and Affected Versions: Lingdang CRM versions through 8.6.5.4 Description: A SQL injection issue exists in the crm/WeiXinApp/yunzhijia/event.php file. Manipulation of the openid argument can lead to SQL injection, and the attack can be launched remotely. The exploit...

CVE-2024-51482: Improper Neutralization of Special Elements used in an SQL Command

ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder v1.37. = 1.37.64 is vulnerable to boolean-based SQL Injection in function of web/ajax/event.php. This is fixed in 1.37.65...

Sql injection

Church Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/editevent.php...

Sourcecodester Alumni Management System SQL Injection Vulnerability

Sourcecodester Alumni Management System is a Php, Mysql-based alumni management system from Sourcecodester, Inc. SourceCodester Alumni Management System version 1.0 is vulnerable to SQL injection, which allows remote attacker can exploit this vulnerability to execute arbitrary SQL statements via...

Sourcecodester Alumni Management System SQL注入漏洞

Sourcecodester Alumni Management System is a Php, Mysql-based alumni management system from Sourcecodester, Inc. SourceCodester Alumni Management System version 1.0 is vulnerable to SQL injection, which allows remote attacker can exploit this vulnerability to execute arbitrary SQL statements via...

(0Day) Horde Groupware Webmail Edition Event event_alarms Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Horde Groupware Webmail Edition. Authentication is required to exploit this vulnerability. The specific flaw exists within Event.php. When parsing the eventalarms parameter, the process does not...

CVE-2018-19908: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered in MISP 2.4.9x before 2.4.99. In app/Model/Event.php the STIX 1 import code, an unescaped filename string is used to construct a shell command. This vulnerability can be abused by a malicious authenticated user to execute arbitrary commands by tweaking the original filenam...

Sql injection

SQL Injection exists in Event Manager 1.0 via the event.php id parameter or the page.php slug parameter...

CVE-2018-6576

SQL Injection exists in Event Manager 1.0 via the event.php id parameter or the page.php slug parameter...

CVE-2018-6576: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection exists in Event Manager 1.0 via the event.php id parameter or the page.php slug parameter...

CVE-2018-5315

The Wachipi WP Events Calendar plugin 1.0 for WordPress has SQL Injection via the eventid parameter to event.php...

Sql injection

The Wachipi WP Events Calendar plugin 1.0 for WordPress has SQL Injection via the eventid parameter to event.php...

CVE-2018-5315: Improper Neutralization of Special Elements used in an SQL Command

The Wachipi WP Events Calendar plugin 1.0 for WordPress has SQL Injection via the eventid parameter to event.php...