PT-2026-83134

A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated attackers to execute arbitrary shell commands via the 'url' parameter...

CVE-2026-50979

Osbil Technology oPanel (v1.19.50 and earlier) contains a command injection vulnerability in the advanced/curl endpoint. The url parameter is not adequately sanitized before being passed to the system's curl execution routine. An authenticated attacker can bypass space restrictions using shell va...

EUVD-2026-67772

An OS command injection vulnerability in the killSessionSync function lib/agent-runtime.ts of 23blocks-OS ai-maestro v0.24.17 allows attackers to execute arbitrary commands via a crafted input...

PT-2026-83349

Name of the Vulnerable Software and Affected Versions MariaDB Connector/Node.js versions prior to 3.2.4 MariaDB Connector/Node.js versions prior to 3.3.3 MariaDB Connector/Node.js versions prior to 3.4.6 MariaDB Connector/Node.js versions prior to 3.5.3 Description SQL injection is possible when...

PT-2026-83251

Name of the Vulnerable Software and Affected Versions Yamcs versions prior to 5.12.8 Yamcs versions prior to 5.13.2 Description Yamcs compiles StreamSQL query expressions to Java at runtime using Janino. The LIKE operator inserts user-supplied patterns into the generated Java source unescaped. An...

CVE-2026-37751

An OS command injection vulnerability in the killSessionSync function (lib/agent-runtime.ts) of 23blocks-OS ai-maestro v0.24.17 allows remote attackers to execute arbitrary commands via a crafted input. The vulnerability is rated CVSS 9.8 (Critical) with a network attack vector requiring no privi...

PT-2026-82834

In openNDS before 11.0.0, the client params.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by...

CVE-2026-37751

An OS command injection vulnerability in the killSessionSync function lib/agent-runtime.ts of 23blocks-OS ai-maestro v0.24.17 allows attackers to execute arbitrary commands via a crafted input...

PT-2026-83281

Name of the Vulnerable Software and Affected Versions Flextype CMS versions prior to 1.0.0-dev Description An expression language injection exists that allows authenticated attackers with a valid API token to read arbitrary files. This occurs when unsanitized user input is passed to the Symfony...

PT-2026-82832

openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on the /opennds preauth/ endpoint because of libopennds.sh...

openSUSE 16 Security Update : rsync (openSUSE-SU-2026:21650-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21650-1 advisory. - CVE-2026-53783: rrsync restricted-directory escape validation-vs-exec race + unsafe option allowlist bsc1269041. - CVE-2026-53784: Daemon...

CVE-2026-9082

Scanner Drupal CVE-2026-9082 Scanner semipassivo que detecta instalações Drupal potencialmente vulneráveis ao CVE-2026-9082 injeção SQL no PostgreSQL. Nenhum payload SQL enviado. Nenhuma solicitação que altere o estado. Versões Vulneráveis Ramo| Afetado| Corrigido ---|---|--- 10.4.x| 8.9.0 —...

CVE-2025-7753

🚨 CVE-2025-7753 — Exploit PoC di SQL Injection Autore: Byte Reaper Telegram: @ByteReaper0 CVE: CVE‑2025‑7753 Vulnerabilità: SQL Injection non autenticata, basata sul tempo 🔍 Panoramica Una vulnerabilità critica di SQL Injection esiste in Online Appointment Booking System 1.0 Code‑Projects nel fil...

cve-2025-6907

CVE‑2025‑6907 Strumento di Exploit SQLi File: exploit.c Autore: Byte Reaper Servizio Target: CODEPROJECT Tipo: Iniezione SQL 🔎 Panoramica Questo è un exploit standalone in C per iniezione SQL che mira alla vulnerabilità CVE‑2025‑6907 nel servizio CODEPROJECT. Combina diverse tecniche avanzate:...

frevvomapexec

frevvomapexec frevvomapexec ist ein Skript zur Überprüfung der Existenz einer blinden SQL-Injection-Schwachstelle, indem eine von Ihnen gewählte Verzögerung in Sekunden in Square 9 GlobalForms 6.2 injiziert wird. Um zu bestätigen, dass die Schwachstelle legitim ist, wird der Endbenutzer...

CVE-2025-6860

CVE-2025-6860 Exploit-Tool Ein Proof-of-Concept-Kommandozeilenwerkzeug in C zum Erkennen und rudimentären Ausnutzen der SQL-Injection-Schwachstelle CVE‑2025‑6860 in staffcommision.php Parameter fromdate und todate. Nutzt libcurl für HTTP-Anfragen, wechselt durch gängige Payloads und User-Agents,...

CVE-2023-28354

CVE-2023-28354 Vulnerability Description È stata identificata una vulnerabilità in Opsview Monitor Agent 6.8 che consente a un attaccante remoto non autenticato di eseguire comandi arbitrari. Un attaccante non autenticato può sfruttare questa vulnerabilità su Windows fornendo una sequenza di esca...

CVE-2025-11077

CVE-2025-11077 - SQL Injection Autor: Byte Reaper Beschreibung Diese Schwachstelle ist eine Blind-SQL-Injection in der Datei addcontent.php des Online Learning Management Systems CVE-2025-11077, die es einem Angreifer ermöglicht, Datenbankinformationen durch das Senden präparierter POST-Anfragen ...

CVE-2025-32429

CVE-2025-32429 PoC di SQL Injection in XWiki Autore: Byte Reaper Telegram: @ByteReaper0 CVE: CVE‑2025‑32429 Vulnerabilità: Blind SQL Injection nell'API REST LiveData di XWiki File interessato: getdeleteddocuments.vm parametro sort Descrizione : Una vulnerabilità di SQL Injection cieca esiste...

CVE-2019-6690-python-gnupg-vulnerability

CVE-2019-6690: Validazione impropria dell'input in python-gnupg 0.4.3 Abbiamo scoperto un modo per iniettare dati tramite la proprietà passphrase dei metodi gnupg.GPG.encrypt e gnupg.GPG.decrypt quando viene utilizzata la crittografia simmetrica. La passphrase fornita non viene validata per i...