CVE-2026-41462

🚨 CVE-2026-41462 - ProjeQtor Unauthenticated SQL Injection Critical Unauthenticated SQL Injection in ProjeQtor ≤ 12.4.3 📌 Overview CVE-2026-41462 is a critical unauthenticated SQL Injection vulnerability in the login functionality of the ProjeQtor project management tool. CVE ID : CVE-2026-41462...

CVE-2026-23500

CVE-2026-23500: OS Command Injection RCE via MAINODTASPDF configuration in Dolibarr Overview Field| Details ---|--- CVE ID| CVE-2026-23500 Severity| CRITICAL Advisory| GHSA-w5j3-8fcr-h87w Discovered by| Lukasz Rybak Affected Products Dolibarr/dolibarr versions: = 22.0.4 Patched in: 23.0 CWE...

apache-camel-docling-security-assessment

CVE-2026-40047 - Apache Camel Docling CLI Argument Injection Consultant-Style Cybersecurity Report Professional vulnerability assessment report for Apache Camel Docling argument validation risk, including technical impact, remediation, and mitigation strategy. 📍 Report Snapshot Field| Details...

joomla_exploits

Joomla Exploits This repository contains selected Joomla exploit artifacts validated against real Docker Joomla environments. The collection is split by practical offensive utility. real-impact Exploits with direct security impact: RCE, file upload to code execution, SQL injection, sensitive...

CVE-2026-53574

EspoCRM is an open source customer relationship management application. From 8.1.0 until 9.3.8, an authenticated non-administrator can submit a crafted where parameter to the GET entity streamAttachments endpoint because that query path permits complex expressions. Boolean-based blind SQL injecti...

CVE-2026-53575

EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an authenticated administrator can place crafted content in the applicationName setting through CSP nonce injection. The persistent injection is inserted into the main application page without escaping, allowi...

CVE-2026-110957

A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2V250604. The affected element is the function sub12580 of the file api.cgi of the component Login Processing. The manipulation of the argument REMOTEADDR leads to os command injection. It is possible to initiate the attack...

CVE-2026-104586

AUTOM8N WHM/cPanel plugin through commit 82821f7 contains an OS Command Injection in borgrestore.cgi...

CVE-2026-106149

In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource fields by string concatenation without proper neutralization. An attacker with low privileges who can control these fields can inject JavaScript event-handler attributes th...

CVE-2026-57588-Nessus-XML-Import-SQL-Injection-PoC

🛡️ CVE-2026-57588 - Nessus SQL Injection Exploitation Framework 📋 Table of Contents Overview Vulnerability Details Features Installation Quick Start Usage Examples Payload Types Advanced Scenarios Reporting Troubleshooting Security Considerations License 🔍 Overview CVE-2026-57588 is a critical SQL...

CVE-2026-49042

CVE-2026-49042 — camel-langchain4j-tools Prompt-Injection → Header-Injection Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack| Hijacked sink| Demonstrated impact ---|---|---|---|--- Camel Spring Boot| camel-spring-boot/|...

CVE-2026-63030

CVE-2026-63030 - WordPress REST API Batch Route Confusion PoC Description Proof-of-concept exploit for CVE-2026-63030, a pre-authentication vulnerability in WordPress versions 6.9.0 through 7.0.1. It chains: REST API batch route confusion validation vs dispatch mismatch SQL injection via...

CVE-2026-58395 OPNsense: XPath injection in MVC safe-delete

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the safe-delete path reached through ApiMutableModelControllerBase::delBase interpolates an unvalidated safe-delete token from the request URL into an XPath expression over config.xml before confirming that the...

CVE-2026-58395

OPNsense versions prior to 26.1.11 are vulnerable to an XPath injection vulnerability in the ApiMutableModelControllerBase::delBase() safe-delete path. The flaw occurs because an unvalidated safe-delete token from the request URL is interpolated into an XPath expression against config.xml before ...

CVE-2026-58395 OPNsense: XPath injection in MVC safe-delete

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the safe-delete path reached through ApiMutableModelControllerBase::delBase interpolates an unvalidated safe-delete token from the request URL into an XPath expression over config.xml before confirming that the...

CVE-2026-44680-MikroORM-SQL-Injection-Exploit-Framework

CVE-2026-44680 - MikroORM SQL Injection Exploit Framework Professional Proof-of-Concept Tool for Security Researchers 🔍 Overview CVE-2026-44680 is a critical SQL injection vulnerability affecting MikroORM, a popular TypeScript ORM for Node.js. This exploit framework provides security researchers...

CVE-2019-18890

CVE-2019-18890 CVE-2019-18890 POC Proof of Concept REDMINE UP TO 3.2.9/3.3.9 SQL INJECTION https://nvd.nist.gov/vuln/detail/CVE-2019-18890 Requirements: Access credentials Subproject is required REST API is enabled On Mysql the first query on which injection occurs looks like the example below wi...

CVE-2022-44830

Suggested description Sourcecodester Event Registration App v1.0 was discovered to contain multiple CSV injection vulnerabilities via the First Name, Contact and Remarks fields. These vulnerabilities allow attackers to execute arbitrary code via a crafted excel file. Additional Information Proof ...

600,000 WordPress Sites Affected by SQL Injection Vulnerability in Backuply WordPress Plugin

On September 17th, 2026, we received a submission for a Second-Order SQL Injection vulnerability in Backuply, a WordPress plugin with more than 600,000 active installations. This vulnerability makes it possible for authenticated attackers with subscriber-level access and above to store a maliciou...

CVE-2025-4578

CVE-2025-4578 File Provider = 1.2.3 - Unauthenticated SQL Injection Description The File Provider plugin for WordPress is vulnerable to SQL Injection via the 'fileId' parameter in all versions up to, and including, 1.2.3 due to insufficient escaping on the user supplied parameter and lack of...