metasploitable2-exploitation-metasploit

Exploiting Metasploitable2 with Metasploit: VSFTPD, Samba, and More A hands-on walkthrough of exploitation using the Metasploit Framework — from PostgreSQL database setup and dbnmap scanning, through three root shells via vsftpd, Samba, and UnrealIRCd, to credential exfiltration with Netcat...

CVE-2026-91784

cjbassi/gotop is vulnerable to local argument injection via process termination functionality. The process name is passed directly to pkill without sanitization. A local attacker can create a process with a crafted name beginning with -- e.g. containing a target user's UID. When the user running...

CVE-2026-80298 SQL Injection in HAVELSAN's Sef - AI Chatbot Platform

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows SQL Injection. This issue affects Sef - AI Chatbot Platform: before 2.1. NOTE: The vendor was contacted and it was learned that the product is not...

EUVD-2026-91329

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows SQL Injection. This issue affects Sef - AI Chatbot Platform: before 2.1. NOTE: The vendor was contacted and it was learned that the product is not...

CVE-2026-80298

A SQL injection vulnerability exists in the HAVELSAN Inc. Sef - AI Chatbot Platform affecting versions before 2.1 . The flaw stems from the improper neutralization of special elements used in SQL commands, which could allow an attacker to execute unauthorized queries. The vendor has stated that t...

CVE-2026-80298 SQL Injection in HAVELSAN's Sef - AI Chatbot Platform

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows SQL Injection. This issue affects Sef - AI Chatbot Platform: before 2.1. NOTE: The vendor was contacted and it was learned that the product is not...

WordPress WP Data Access plugin <= 5.5.82 - SQL Injection vulnerability

SQL Injection vulnerability discovered by neurotx in WordPress Plugin WP Data Access versions = 5.5.82...

CVE-2026-69083_exploit

CVE-2026-69083 — SiYuan 未認証SQLインジェクション SiYuan（Goベースのナレッジベースアプリ）のアセットコンテンツ検索エンドポイントにおける未認証SQLインジェクション。 POST /api/search/fullTextSearchAssetContent は、ユーザーが制御する query 値をエスケープなしでREGEXP句に直接連結して、生のSQL文を構築します（kernel/model/assetcontent.go、assetContentFieldRegexp）： SELECT FROM...

WordPress WPLMS theme <= 4.973 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Rafie Muhammad in WordPress Theme WPLMS versions = 4.973...

CVE-2021-35042

CVE-2021-35042: Django SQL injection vulnerability I. Overview Django is an open-source Web Application Framework written in Python, built according to the MVC Model - View - Controller model. It was originally built to manage news content websites owned by the Lawrence publishing corporation, as...

CVE-2026-91784

The cjbassi/gotop utility is vulnerable to local argument injection within its process termination functionality. The software fails to sanitize process names before passing them directly to the pkill command. A local attacker can exploit this by creating a process with a crafted name starting wi...

EUVD-2026-91318

cjbassi/gotop is vulnerable to local argument injection via process termination functionality. The process name is passed directly to pkill without sanitization. A local attacker can create a process with a crafted name beginning with -- e.g. containing a target user's UID. When the user running...

CVE-2026-91784 Argument Injection leading to arbitrary process termination in gotop

cjbassi/gotop is vulnerable to local argument injection via process termination functionality. The process name is passed directly to pkill without sanitization. A local attacker can create a process with a crafted name beginning with -- e.g. containing a target user's UID. When the user running...

CVE-2026-91784 Argument Injection leading to arbitrary process termination in gotop

cjbassi/gotop is vulnerable to local argument injection via process termination functionality. The process name is passed directly to pkill without sanitization. A local attacker can create a process with a crafted name beginning with -- e.g. containing a target user's UID. When the user running...

CVE-2026-91784 Argument Injection leading to arbitrary process termination in gotop

cjbassi/gotop is vulnerable to local argument injection via process termination functionality. The process name is passed directly to pkill without sanitization. A local attacker can create a process with a crafted name beginning with -- e.g. containing a target user's UID. When the user running...

CVE-2026-11120-Command-Injection-via-Git-URL-in-CI-CD-Pipeline

CVE-2026-11120 – CI/CDパイプラインにおけるGit URLを介したコマンドインジェクション プログラムコード（Python） cicdbuild.py - Clones repository without sanitizing URL import subprocess, sys def cloneandbuildrepourl: Vulnerability: repourl can contain shell metacharacters cmd = f"git clone repourl /tmp/repo" subprocess.checkcallcmd,...

CVE-2026-97634

The Event Tickets and Registration plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.29.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2026-12951

The Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the /multivendorx/v1/compliance/report-abuse REST endpoint in versions up to and including 5.0.18. This is due to insufficient escaping on the user supplied parameter and lack of...

WordPress WPLMS plugin < 1.9.9.8.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Rafie Muhammad in WordPress Plugin WPLMS versions 1.9.9.8.2...

CVE-2018-25031

Swagger UI Cross-Site Scripting POC: CVE-2018-25031 using Selenium in Python This repository contains a Python script that demonstrates a proof of concept POC of a Cross-Site Scripting XSS vulnerability in Swagger UI, using the Selenium library. The goal of this POC is to identify websites that a...