CVE-2026-78691

ash_sql (an Elixir query library from the Ash ecosystem) is vulnerable to LIKE wildcard injection in its contains/2, string_starts_with/2, and string_ends_with/2 filters. The escape helpers prefix % and _ with a backslash but fail to escape a pre-existing backslash in user input, so \% becomes a ...

CVE-2026-78691 Unescaped backslash allows LIKE wildcard injection in AshSql string search

Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ashsql allows a user who supplies a search term to contains/2, stringstartswith/2, or stringendswith/2 to inject live SQL LIKE wildcards, turning a literal substring search into an attacker-controlled...

CVE-2026-78691 Unescaped backslash allows LIKE wildcard injection in AshSql string search

Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ashsql allows a user who supplies a search term to contains/2, stringstartswith/2, or stringendswith/2 to inject live SQL LIKE wildcards, turning a literal substring search into an attacker-controlled...

CVE-2026-78038 Job argument injection via :args overrides primary_key and tenant in AshOban

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ashoban allows a user whose input reaches the :args option of AshOban.buildtrigger/3 to retarget an update or destroy trigger at another record, including across tenants. buildtrigger/3...

CVE-2026-78038 Job argument injection via :args overrides primary_key and tenant in AshOban

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ashoban allows a user whose input reaches the :args option of AshOban.buildtrigger/3 to retarget an update or destroy trigger at another record, including across tenants. buildtrigger/3...

CVE-2026-78038

ash_oban (an Elixir library bridging Ash and Oban) contains an improperly controlled modification of dynamically-determined object attributes flaw in AshOban.build_trigger/3. The function builds trusted job arguments with atom keys and merges caller-supplied :args underneath, intending trusted va...

cve-2026-82222-poc

CVE-2026-82222 Unauthenticated PHP object injection to RCE in GiveWP = 4.16.7.1. Patched in 4.16.7.2...

CVE-2026-82540

itsourcecode Sales and Inventory System 1.0 is affected by a SQL injection vulnerability in the file /pages/cust_searchfrm.php, triggered by manipulation of the ID parameter. The vulnerable function is not further specified in the provided documents. Remote exploitation is possible with low privi...

CVE-2026-82540 itsourcecode Sales and Inventory System cust_searchfrm.php sql injection

A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/custsearchfrm.php. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and mig...

EUVD-2026-68184

A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/custsearchfrm.php. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and mig...

CVE-2026-38945

CVE-2026-38945 author: Rafael José Núñez Gulías company: Iberian Var Group Affected products: RayVentory Scan Engine 12.6 Update 8 and previous versions Raynet advisory: RSEC200967 rvia in Raynet executes a find command with improperly terminated search criteria to locate Java installations when...

powerfulseal

PowerfulSeal PowerfulSeal injects failure into your Kubernetes clusters, so that you can detect problems as early as possible. It allows for writing scenarios describing complete chaos experiments. Embrace the inevitable failure. Embrace The Seal. Documentation Please refer to the Powerfulseal...

rebuff

Rebuff.ai Self-hardening prompt injection detector Rebuff is designed to protect AI applications from prompt injection PI attacks through a multi-layered defense. Playground • Discord • Features • Installation • Getting started • Self-hosting • Contributing • Docs Disclaimer Rebuff is still a...

cve-2024-36401-geoserver-rce

CVE-2024-36401 — RCE no autenticada en GeoServer Un estudio completo y reproducible de la vulnerabilidad CVE-2024-36401 , un fallo de ejecución remota de código no autenticado en GeoServer — el servidor de código abierto más utilizado para datos geoespaciales. El error es una inyección de eval : ...

CVE-2017-5638

LAB 1 — Apache Struts2 OGNL Injection CVE-2017-5638 / S2-045 I. SYSTEM ANALYSIS Attack Surface Analysis After starting the container, Struts2 logs show that the application loads familiar configuration files such as struts-default.xml , struts-plugin.xml , and struts.xml. This confirms that the...

CVE-2026-73847-emlog-PoC

CVE-2026-73847 — emlog AI Assistant CSRF → SQL Execution → Admin Takeover PoC for missing CSRF protection on emlog pro's AI Assistant executetool endpoint, which lets an attacker ride an admin's authenticated session to run arbitrary SQL against the site database — including a full admin account...

CVE-2026-24061

Telnet Vulnerability Scanner & Exploiter This Python script main.py is a multi-threaded tool designed to scan a list of target IPs/hostnames and attempt to exploit a specific vulnerability over Telnet. !WARNING This tool is intended for educational purposes and authorized penetration testing only...

CVE-2026-40176

CVE-2026-40176 — Composer Perforce Driver Command Injection Proof of Concept A self-contained, OOP-style PHP proof of concept that demonstrates and differentially verifies a command-injection vulnerability in Composer's Perforce repository driver. The PoC runs the same malicious composer.json...

CVE-2020-25273

CVE-2020-25273 Online Bus Booking System 1.0, there is Authentication bypass on the Admin Login screen in admin.php via username or password SQL injection. Vendor - SourceCodester Product -https://www.sourcecodester.com/php/14438/online-bus-booking-system-project-using-phpmysql.html V 1.0...

Manipulating-Web-Agents

Manipulating Autonomous LLM-based Web Agents with Indirect Prompt Injection Attacks With the ubiquity of LLM-integrated applications, investigating potential security risks is crucial. One of the most significant vulnerabilities in these systems is their susceptibility to adversarial attack via...