EUVD-2026-68787

Unauthenticated SQL Injection in Throws SPAM Away = 3.8.2 versions...

CVE-2026-81763

CVE-2026-81763 is an unauthenticated SQL injection vulnerability in the WordPress plugin Throws SPAM Away (versions ≤ 3.8.2 ), discovered by Jiemook . The flaw allows a network-based attacker with no privileges to inject SQL queries, leading to a High impact on confidentiality and a Low impact on...

CVE-2026-81756

An unauthenticated SQL injection vulnerability exists in the WordPress plugin Smart Marketing SMS and Newsletters Forms in versions

EUVD-2026-68784

Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms = 5.1.24 versions...

CVE-2026-81756 WordPress Smart Marketing SMS and Newsletters Forms plugin <= 5.1.24 - SQL Injection vulnerability

Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms = 5.1.24 versions...

EUVD-2026-68780

Unauthenticated SQL Injection in WP Data Access = 5.5.81 versions...

CVE-2026-81293

CVE-2026-81293 is an unauthenticated SQL injection vulnerability in the WP Data Access WordPress plugin, affecting versions 5.5.81 and below . The flaw was discovered by sequence_X0 and reported via Patchstack. The CVSS v3.1 score is 9.3 (Critical) , with a network attack vector, low complexity, ...

CVE-2026-81293 WordPress WP Data Access plugin <= 5.5.81 - SQL Injection vulnerability

Unauthenticated SQL Injection in WP Data Access = 5.5.81 versions...

EUVD-2026-68777

Subscriber SQL Injection in Charitable = 1.8.12.1 versions...

CVE-2026-81287 WordPress Charitable plugin <= 1.8.12.1 - SQL Injection vulnerability

Subscriber SQL Injection in Charitable = 1.8.12.1 versions...

CVE-2026-81287

CVE-2026-81287 affects the WordPress Charitable plugin in versions 1.8.12.1 and earlier , where a subscriber-level SQL injection vulnerability exists. The flaw allows an authenticated subscriber to exploit a SQL injection, with a CVSS 3.1 score of 8.5 (HIGH) . The vector CVSS:3.1/AV:N/AC:L/PR:L/U...

Injection-vulnerability-in-Paradox-Security-Systems-IPR512-CVE-2023-24709-PoC

Vulnérabilité d'injection dans Paradox Security Systems IPR512 - CVE-2023-24709 PoC Dans la page du formulaire de connexion de la console Web IPR512 du système de sécurité Paradox, un attaquant peut saisir une chaîne JavaScript, telle que , qui écrasera les configurations du fichier « login.xml »...

cve-2026-54316-lab

CVE-2026-54316 — Laboratoire d'exfiltration Claude Code WebFetch HuggingFace Un laboratoire autonome et jetable qui reproduit GHSA-fg94-h982-f3mm / CVE-2026-54316 : Claude Code a pré-approuvé huggingface.co comme nom d'hôte nu pour l'outil WebFetch, de sorte que tout chemin sur ce domaine — y...

CVE-2026-54179 backpack/crud: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.37, the src/app/Library/Uploaders/SingleBase64Image.php methods SingleBase64Image::uploadFiles and...

cve-2025-58360

GeoServer : CVE-2025-58360 Avertissement Le code et les informations contenus dans ce dépôt sont fournis à des fins éducatives et de recherche uniquement. Le propriétaire du dépôt décline toute responsabilité quant à ce que vous faites avec le code et/ou les informations de ce dépôt. Vos actions...

About Remote Code Execution - Zimbra Collaboration (CVE-2026-73570) vulnerability

About Remote Code Execution - Zimbra Collaboration CVE-2026-73570 vulnerability. Zimbra Collaboration is a collaboration software suite that includes a mail server and web client. In terms of functionality, it is comparable to Microsoft Exchange. The vulnerability allows an unauthenticated attack...

CVE-2017-8917-Joomla

CVE-2017-8917-Joomla Python 스크립트로 Joomla! 3.7.0의 CVE-2017-8917 SQL 인젝션 취약점을 익스플로잇합니다. 교육 목적으로만 제작되었습니다. TryHackMe Dailybugle CTF에서 사용되었습니다. 주의사항 이 저장소의 모든 스크립트/바이너리는 승인된 침투 테스트 및/또는 교육 목적으로만 사용되어야 합니다. 이 소프트웨어의 오용에 대한 책임은 작성자나 다른 협력자에게 없습니다. 자신의 네트워크 및/또는 네트워크 소유자의 허가를 받아 사용하십시오. 사용법 root@kitploi...

CVE-2023-49954.github.io

Injection SQL dans l'intégration CRM 3CX Pour l'intégration CRM, 3CX fournit des modèles pour se connecter à diverses bases de données. Dans ces modèles, des espaces réservés FirstName,SearchText,Email sont utilisés pour remplir les requêtes. Les entrées utilisateur ne sont pas assainies, ce qui...

log4j-vulnerable-app-cve-2021-44228-terraform

log4j-vulnerable-app-cve-2021-44228-terraform Un Terraform pour déployer une application vulnérable et un JNDIExploit pour fonctionner avec CVE-2021-44228 À propos de la stack Ce Terraform crée deux instances sur un VPC dans AWS Cloud. Vous avez juste besoin d'exporter vos AWSACCESSKEYID et...

fastjson-1.2.60-rce

Fastjson = 1.2.60 - Vulnérabilité de désérialisation Contournement de la liste de blocage autoType avec 2 gadgets JNDIConfiguration, OracleManagedConnectionFactory Gadgets root@kitploit: 经过测试，命中的4个文件都是可以利用的。 不过其中HikariConfig类就是前文提到的类，在最新版本被加入黑名单，JNDIConnectionPool类在42版本前就被加入黑名单了。...