EUVD-2026-97135

A security flaw has been discovered in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected by this vulnerability is the function WmToMoveGoodsController.list of the file src/main/java/com/zzjee/wm/controller/WmToMoveGoodsController.java of the component PDA Interface. Performing a manipulation of th...

CVE-2026-108781

The erzhongxmu JEEWMS software (up to version 2026.09.27-W39 ) is vulnerable to a SQL injection flaw within the PDA Interface component. The vulnerability exists specifically in the WmToMoveGoodsController.list function located in the file src/main/java/com/zzjee/wm/controller/WmToMoveGoodsContro...

CVE-2026-108781 erzhongxmu JEEWMS PDA WmToMoveGoodsController.java WmToMoveGoodsController.list sql injection

A security flaw has been discovered in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected by this vulnerability is the function WmToMoveGoodsController.list of the file src/main/java/com/zzjee/wm/controller/WmToMoveGoodsController.java of the component PDA Interface. Performing a manipulation of th...

CVE-2026-34197

CVE-2026-34197 Description Improper Input Validation, Improper Control of Generation of Code ‘Code Injection’ vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access polic...

log4shell-poc

CVE-2021-44228 Log4Shell POC Overview Proof of Concept for Remote Code Execution via JNDI Injection vulnerability in Apache Log4j 2.14.1. Web Hacking Course - Week 11 Assignment. Environment Role| Software| Version ---|---|--- Victim Server| Spring Boot + Log4j| 2.6.1 + 2.14.1 Victim JDK| OpenJDK...

CVE-2025-52399-SQLi-Institute-of-Current-Students

CVE-2025-52399 - SQL Injection in Institute of Current Students Summary The loginlinkfaculty endpoint in the Institute-of-Current-Students application is vulnerable to SQL Injection via the fid POST parameter. The parameter is not properly sanitized before being used in a SQL query, allowing remo...

wp2shell

wp2shell Pre-authentication remote code execution for WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1. Chains CVE-2026-63030 batch route confusion SQLi with CVE-2026-60137 customizer changeset re-entry to achieve unauthenticated administrator creation and OS command execution. No password cracking required...

poc-CVE-2019-9053

PoC CVE-2019-9053 - CMS Made Simple SQL Injection Educational PoC in Python 3 for CVE-2019-9053, a time-based blind SQL Injection vulnerability in CMS Made Simple = 2.2.9. This version has been modified for use in CTF/lab environments. It includes pre-configured prefixes to reduce extraction time...

EUVD-2026-97134

A vulnerability was identified in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected is the function WmSttInGoodsController.list of the file src/main/java/com/zzjee/wm/controller/WmSttInGoodsController.java. Such manipulation of the argument searchstr leads to sql injection. The attack may be...

CVE-2026-108779 erzhongxmu JEEWMS WmSttInGoodsController.java WmSttInGoodsController.list sql injection

A vulnerability was identified in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected is the function WmSttInGoodsController.list of the file src/main/java/com/zzjee/wm/controller/WmSttInGoodsController.java. Such manipulation of the argument searchstr leads to sql injection. The attack may be...

CVE-2026-108779

A SQL injection vulnerability exists in erzhongxmu JEEWMS (versions up to 2026.09.27-W39). The flaw is located in the WmSttInGoodsController.list function within the file src/main/java/com/zzjee/wm/controller/WmSttInGoodsController.java. Specifically, improper handling of the searchstr argument a...

Amazon Linux 2 : libXrender (ALAS-2026-3983)

The version of libXrender installed on the remote host is prior to 0.9.10-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3983 advisory. A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into...

CVE-2026-109626: Improper Neutralization of Special Elements used in an SQL Command

Frappe ERPNext before 16.34.2 contains an SQL injection vulnerability caused by missing input validation in multiple endpoints. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the database...

PT-2026-110616

Name of the Vulnerable Software and Affected Versions Thelia version 2.6.1 Description The translation editor contains path traversal and PHP code injection flaws that can be chained to achieve remote code execution. The item name parameter, used to construct the translation file's write path,...

PT-2026-110513

Name of the Vulnerable Software and Affected Versions Kong Gateway versions prior to 3.9.4 Description A SQL Injection SQLi exists in the clustering communication logic of Kong Gateway Enterprise and Open Source when operating in Hybrid Mode. An attacker can trigger this issue by sending speciall...

PT-2026-110535

Name of the Vulnerable Software and Affected Versions Tuleap Enterprise Edition version 17.5 Description An SQL Injection flaw allows an attacker to obtain read access to the database. SQL Injection is a technique where malicious SQL statements are inserted into entry fields for execution,...

CVE-2026-1907: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection SQLi affects the Kong Gateway Enterprise and Open Source clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane CP, leading to potential unauthorized database access. Leveraging the...

VulnCheck KEV: CVE-2026-0702

The VidShop – Shoppable Videos for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'fields' parameter in all versions up to, and including, 1.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

EulerOS 2.0 SP13 : cpio (EulerOS-SA-2026-4128)

According to the versions of the cpio packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : GNU cpio is vulnerable to an uncontrolled memory allocation in the makepath function at src/makepath.c. The function uses alloca to allocate stack...

ALSA-2026:80507 Important: emacs security update

GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language elisp, and the capability to read e-mail and news. Security Fixes: emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image CVE-2026-772...