153 matches found
CVE-2022-34265
CVE-2022-34265 CVE-2022-34265에 대한 PoC 설명 Django 3.2 3.2.14 미만 및 4.0 4.0.6 미만에서 문제가 발견되었습니다. Trunc 및 Extract 데이터베이스 함수는 신뢰할 수 없는 데이터가 kind/lookupname 값으로 사용될 경우 SQL 인젝션에 취약합니다. 조회 이름 및 종류 선택을 알려진 안전 목록으로 제한하는 애플리케이션은 영향을 받지 않습니다. 사용 방법 시작 git clone https://github.com/ZhaoQi99/CVE-2022-34265.git cd...
CVE-2022-34265
CVE-2022-34265 취약점 요약 이 취약점은 Django에서 날짜 데이터에 사용되는 Trunc 및 Extract 함수의 인수에 대해 SQL을 실행할 때 부적절한 문자열 처리로 인해 발생합니다. Trunc의 kind 인수 또는 Extract의 lookupname 인수에 요청 매개변수를 그대로 지정하면 임의의 SQL 조각이 실행될 수 있는 위험이 있습니다. 이 취약점을 악용하면 제3자가 데이터베이스에 명령을 보내 허가되지 않은 데이터에 접근하거나 데이터베이스를 삭제할 수 있습니다...
CVE-2026-87115
The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for unauthenticated attackers to delete arbitrary files...
CVE-2026-87115 VikAppointments Services Booking Calendar <= 1.2.21 - Unauthenticated Arbitrary File Deletion via 'old_vapcfN' Parameter
The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for unauthenticated attackers to delete arbitrary files...
EUVD-2026-91958
The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for unauthenticated attackers to delete arbitrary files...
CVE-2026-87115
The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to unauthenticated arbitrary file deletion in all versions up to and including 1.2.21 . The root cause is insufficient file path validation within the extract function, specifically involving the old_vapcfN parameter...
WeGIA < 3.6.5 - Unauthenticated Authentication Bypass via extract()
WeGIA 3.6.5 contains an authentication bypass caused by unsafe use of extract on $REQUEST, letting unauthenticated attackers bypass authentication and access protected areas, exploit requires no authentication. id: CVE-2026-28411 info: name: WeGIA 3.6.5 - Unauthenticated Authentication Bypass via...
ROS-20261002-73-0035
The vulnerability of the EXTRACT function in the PostgreSQL database management system is related to the lack of protective measures for SQL query structures. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...
Astra Linux – Vulnerability in Python-Django
A issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc and Extract database functions are vulnerable to SQL injection if untrusted data is used as a kind/lookupname value. Applications that restrict the choice of lookup names and kinds to a known safe list are not...
CVE-2026-16759 Tutor LMS <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutorcoursefilterajax AJAX action. This is due to missing authorization on the handler...
The vulnerability of the EXTRACT() function in the PostgreSQL database management system allows a hacker to execute arbitrary code.
The vulnerability of the EXTRACT function in the PostgreSQL database management system is related to the lack of protective measures for SQL query structures. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...
BIT-POSTGRESQL-2026-15741 PostgreSQL expression deparse allows SQL injection via EXTRACT argument
SQL injection in PostgreSQL EXTRACT deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pgdump, psql commands like \sf, and any similar usage in non-core tools. Versions before...
SUSE CVE-2026-15741
SQL injection in PostgreSQL EXTRACT deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pgdump, psql commands like \sf, and any similar usage in non-core tools. Versions before...
CVE-2026-15741 PostgreSQL expression deparse allows SQL injection via EXTRACT argument
SQL injection in PostgreSQL EXTRACT deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pgdump, psql commands like \sf, and any similar usage in non-core tools. Versions before...
CVE-2026-51295
Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
PT-2026-66527
SQLite 3.41 is vulnerable to use after free in the jsonExtractFunc function. Premature release of parsed JSON object memory leads to subsequent illegal access of freed pointer. Remote attackers can trigger this flaw via specially crafted SQL queries, resulting in service crash and sensitive memor...
CVE-2026-17514
A vulnerability was determined in ZJONSSON node-unzipper up to 0.12.3. Affected by this vulnerability is the function Extract of the file lib/extract.js. This manipulation causes path traversal. The attack requires local access. The exploit has been publicly disclosed and may be utilized. The...
CVE-2026-17514 ZJONSSON node-unzipper extract.js Extract path traversal
A vulnerability was determined in ZJONSSON node-unzipper up to 0.12.3. Affected by this vulnerability is the function Extract of the file lib/extract.js. This manipulation causes path traversal. The attack requires local access. The exploit has been publicly disclosed and may be utilized. The...