CVE-2025-70149-SQL-Injection

CVE-2025-70149 — SQLインジェクション研究プロジェクト 概要 CVE-2025-70149（CodeAstro Membership Management System v1.0における重大なSQLインジェクション脆弱性、CVSS 9.8/10）の悪用と緩和を示すセキュリティ研究プロジェクトです。 CVE詳細...

CVE-2026-2586

인증된 GlassFish EL 주입 RCE CVE-2026-2586 GlassFish 관리 콘솔의 Expression Language 주입 취약점으로 인해 인증된 사용자가 관리 웹 인터페이스에서 처리되는 매개변수에 악성 EL 표현식을 주입할 수 있습니다. 성공적으로 악용하면 영향을 받는 서버에서 원격 명령 실행이 발생할 수 있습니다. 이 취약점은 서버 가상 구성 편집 흐름에서 발견되었으며, 여기서 사용자가 제어할 수 있는 매개변수가 애플리케이션에 의해 안전하지 않게 해석됩니다. 이는 다음 이유로 발생합니다: 관리 인터페이스는 ...

CVE-2026-37149

CVE-2026-37149 SQL Injection in GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 Overview CVE ID: CVE-2026-37149 Vulnerability Type: SQL Injection CWE-89 Severity: High Discoverer: Dhyey Patel Description GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0...

EUVD-2026-68360

A security flaw has been discovered in Soarkey StudentManagement and 学生信息管理系统 up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. This affects the function CourseDao.courseranking of the file code/src/dao/CourseDao.java. Performing a manipulation of the argument cno results in sql injection. It is...

CVE-2026-82620 Soarkey StudentManagement/学生信息管理系统 CourseDao.java CourseDao.course_ranking sql injection

A security flaw has been discovered in Soarkey StudentManagement and 学生信息管理系统 up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. This affects the function CourseDao.courseranking of the file code/src/dao/CourseDao.java. Performing a manipulation of the argument cno results in sql injection. It is...

CVE-2026-82620

Soarkey StudentManagement (学生信息管理系统), affected up to commit e08f7f1d5015af407aa4cca0ada3dea189b4937e, contains a SQL injection vulnerability in the function CourseDao.course_ranking within the file code/src/dao/CourseDao.java. Manipulation of the cno argument allows a remote attacker to inject SQ...

EverShop-Lab-CVE-2026-25993

CVE-2026-25993 — EverShop二阶SQL注入实验室 前提条件 Docker Engine 24+ 及 Docker Compose v2+ 2 GB 可用内存 部署 root@kitploit: cd EverShop-Lab/ docker compose up 首次构建需要等待约2分钟（克隆EverShop v2.1.0，编译，运行迁移，填充数据）。 应用将在 http://localhost:3000 可用。 凭据 字段| 值 ---|--- 管理员邮箱| [email protected] 管理员密码| password123 停止/重置...

CVE-2026-28496-Lab

CVE-2026-28496 - FOSSBilling Server-Side Template Injection in Twig Rendering Executive Summary This repository contains a local Docker lab for reproducing and validating CVE-2026-28496, a Server-Side Template Injection vulnerability affecting FOSSBilling's Twig template rendering behavior...

CVE-2025-57819-exploit

CVE-2025-57819 — FreePBX 预认证 SQL 注入到远程代码执行 针对 CVE-2025-57819 的一体化利用工具，该漏洞是 FreePBX 端点模块中未经认证的 SQL 注入漏洞，可通过 cron 任务注入实现远程代码执行。 CVSS : 9.8（严重）— CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CISA KEV : 2025 年 8 月 29 日添加 受影响版本 : Sangoma FreePBX 15、16、17，且端点模块版本 │ ▼ 向 cronjobs 表进行 SQL 注入...

cve-2026-9082

CVE-2026-9082 类型 ：SQL 注入 CWE-89 受影响产品 ：Drupal 核心（数据库抽象 API） Drupal 公告 ：SA-CORE-2026-004 发布时间 ：2026 年 5 月 20 日 严重性 ：高度严重（Drupal 20/25 | NVD CVSS 6.5） 这是什么？ CVE-2026-9082 是 Drupal 核心数据库抽象 API 中的一个 SQL 注入 漏洞。Drupal 的数据库层封装了 PDO 并在查询到达数据库之前对所有查询进行净化处理。此漏洞针对 PostgreSQL 后端 绕过了这一净化机制——精心构造的 HTTP...

Photo Gallery by 10Web < 1.6.0 - SQL Injection

The Photo Gallery by 10Web WordPress plugin before 1.6.0 does not validate and escape the bwgtagidbwgthumbnails0 parameter before using it in a SQL statement via the bwgfrontenddata AJAX action available to unauthenticated and authenticated users, leading to an unauthenticated SQL injection id:...

Ruby on Rails - Open Redirect via Host Header Injection

Ruby on Rails action pack before 6.1.2.1, 6.0.3.5 contains an open redirect caused by special crafted Host headers in combination with allowed host formats, letting attackers redirect users to malicious websites, exploit requires attacker to control Host headers. id: CVE-2021-22881 info: name: Ru...

Razer Sila Gaming Router - Remote Code Execution

A command injection in the command parameter of Razer Sila Gaming Router v2.0.441api-2.0.418 allows attackers to execute arbitrary commands via a crafted POST request. id: CVE-2022-29013 info: name: Razer Sila Gaming Router - Remote Code Execution author: DhiyaneshDK severity: critical descriptio...

Apache Airflow OS Command Injection

Apache Airflow prior to version 2.2.4 is vulnerable to OS command injection attacks because some example DAGs do not properly sanitize user-provided parameters, making them susceptible to OS Command Injection from the web UI. id: CVE-2022-24288 info: name: Apache Airflow OS Command Injection...

Hytec Inter HWL-2511-SS - Remote Command Execution

Hytec Inter HWL-2511-SS v1.05 and below was discovered to contain a command injection vulnerability via the component /www/cgi-bin/popen.cgi. id: CVE-2022-36553 info: name: Hytec Inter HWL-2511-SS - Remote Command Execution author: HuTa0 severity: critical description: | Hytec Inter HWL-2511-SS...

Nagios XI 5.5.6-5.7.5 - Authenticated Remote Command Injection

Nagios XI 5.5.6 through 5.7.5 is susceptible to authenticated remote command injection. There is improper sanitization of authenticated user-controlled input by a single HTTP request via the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php. This in turn can lead to...

MovableType - Remote Command Injection

MovableType 5002 and earlier Movable Type Advanced 7 Series, Movable Type Advanced 6.8. 2 and earlier Movable Type Advanced 6 Series, Movable Type Premium 1.46 and earlier, and Movable Type Premium Advanced 1.46 and earlier allow remote attackers to execute arbitrary OS commands via unspecified...

Tenda Router AC11 - Remote Command Injection

Tenda Router AC11 is susceptible to remote command injection vulnerabilities in the web-based management interface that could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. id: CVE-2021-31755 info: name: Tenda Router AC11 - Remote Comman...

FreePBX >= 17.0.2.36 && < 17.0.3 - Authenticated Command Injection

FreePBX Endpoint Manager 17.0.2.36 to = 17.0.2.36 && 17.0.3 - Authenticated Command Injection author: th3y severity: critical description: | FreePBX Endpoint Manager 17.0.2.36 to 17.0.3 contains a command injection caused by improper sanitization in filestore module's testconnection checksshconne...

FreePBX - Remote Code Execution

FreePBX 15, 16, and 17 contain a remote code execution caused by insufficiently sanitized user-supplied data in endpoints, letting unauthenticated attackers manipulate the database and execute code remotely, exploit requires no authentication. id: CVE-2025-57819 info: name: FreePBX - Remote Code...