CVE-2025-47226

CVE-2025-47226 - IDOR Vulnerability in Snipe-IT = v8.0.4 🚨 Insecure Direct Object Reference IDOR vulnerability in Snipe-IT allows authenticated users to view asset information from other departments by tampering with locationid. ✍️ Discovered By Siripong Jintung GitHub: Sn1p3r-H4ck3r Linkedin:...

WordPress WP Maps Blind SQLi (CVE-2026-39492)

Exploits CVE-2026-39492 in WP Maps = 4.9.1: unauthenticated blind SQL injection via wpgmpajaxcall locationid backtick bypass. Supports time-based confirmation and scalar extraction admin credentials, custom SELECT. !/usr/bin/env python3 -- coding: utf-8 -- from future import annotations from typi...

CVE-2026-3222: Improper Neutralization of Special Elements used in an SQL Command

The WP Maps plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'locationid' parameter in all versions up to, and including, 4.9.1. This is due to the plugin's database abstraction layer FlipperCodeModelBase::iscolumn treating user input wrapped in backticks as column...

EUVD-2008-4586

Malware in sbrugna...

Shuttle-Booking-Software v1.0 - Multiple-SQLi

Title: Shuttle-Booking-Software v1.0 - Multiple-SQLi Author: nu11secur1ty Date: 09/10/2023 Vendor: https://www.phpjabbers.com/ Software: https://www.phpjabbers.com/shuttle-booking-software/sectionPricing Reference: https://portswigger.net/web-security/sql-injection Description: The locationid...

Sql injection

Multiple SQL injection vulnerabilities in IP Reg 0.4 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 locationid parameter to locationdel.php and 2 vlanid parameter to vlanedit.php. NOTE: the vlanview.php and vlandel.php vectors are already covered by CVE-2007-6579...

CVE-2008-4606: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in IP Reg 0.4 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 locationid parameter to locationdel.php and 2 vlanid parameter to vlanedit.php. NOTE: the vlanview.php and vlandel.php vectors are already covered by CVE-2007-6579...