CVE-2020-11800

課題ガイドラインで必須とされるセクションは「Required」と表示されています。 1. 環境 Required Dockerfile Required この環境は、Vulhubが提供する脆弱なZabbix ServerイメージをベースにしたカスタムDockerfileを使用しています。 FROM vulhub/zabbix:3.0.3-server このDockerfileは、脆弱なZabbix 3.0.3サーバ環境を使用してローカルイメージをビルドします。ビルドプロセス中に追加のパッケージや設定は追加されていません。 docker-compose.yml Required...

gogs

gogs 여기에서는 SEED Ubuntu 16.04 VM에 실습 환경을 구축합니다. SQL 인젝션 취약점을 공격하기 전에 먼저 VM에 Go Git ServiceGOGS를 설치해야 합니다. VM을 설정하는 단계는 다음과 같습니다. 1단계: 데이터베이스 설치 시스템에 로그인한 후, 라이브러리와 저장소가 업데이트되었는지 확인하기 위해 다음 명령을 실행해야 합니다. $ sudo apt-get -y update 백엔드에서 MySQL 서버를 사용하므로 VM에 MySQL 서버를 설치해야 합니다. 다음 명령으로 설치할 수 있습니다: $ su...

NextJS-CVE-2025-29927

🔓 NextJS-CVE-2025-29927 - 취약한 데모 애플리케이션 이 프로젝트는 CVE-2025-29927 을 시연하는 취약한 Next.js 애플리케이션 입니다. 이 취약점은 Next.js를 사용하는 웹 애플리케이션에서 부적절한 입력 처리 또는 접근 제어 결함으로 인해 발생하는 보안 결함입니다. 이 프로젝트는 MySQL 백엔드와 JWT 인증을 사용하며 교육 및 테스트 목적 으로만 설계되었습니다. 예를 들어 침투 테스트 실습, 책임 있는 공개 데모, 보안 연구 등에 사용할 수 있습니다. users.csv에 있는 테스트 계정...

CVE-2026-55170

OpenFGA Open Source CVE-2026-55170 affects the MySQL datastore when decisions rely on case-sensitive user strings. The tuple, changelog, and authorization_model identifier columns can treat case-distinct values (e.g., user:Alice vs user:alice) as equivalent, potentially causing two distinct check...

EUVD-2026-31226

An SQL injection vulnerability in the MySQL CNID backend in Netatalk 3.1.0 through 4.4.2 allows a remote authenticated attacker to obtain unauthorized access to data, modify data, or cause a denial of service...

CVE-2026-44047

CVE-2026-44047 affects Netatalk 3.1.0–4.4.2 and is an SQL injection in the MySQL CNID backend. The root cause is improper handling of input in CNID MySQL backend, leading to unauthorized data access, data modification, or DoS when exploited by a remote authenticated attacker. Fixed in 4.4.3; reme...

RUSTSEC-2026-0138 Unsound access to padding bytes while serializing date/time values using the Mysql backend

Diesel-async uses the mysql-async crate for interacting with Mysql compatible databases. This library already provides access to deserialized data for date/time releated types. Diesel-async then translated these deserialized data back to their serialized binary representation to hook into diesels...

Unsound access to padding bytes while serializing date/time values using the Mysql backend

Diesel-async uses the mysql-async crate for interacting with Mysql compatible databases. This library already provides access to deserialized data for date/time releated types. Diesel-async then translated these deserialized data back to their serialized binary representation to hook into diesels...

RUSTSEC-2026-0134 Unsound access to padding bytes while serializing date/time values using the Mysql backend

Diesel relies on libmysqlclient for interacting with Mysql compatible databases. This library requires to provide date/time values according to the byte layout of their MYSQLTIME type. Diesel replicated this type as reprC struct, populated all the fields of this struct and then casted this value ...

Unsound access to padding bytes while serializing date/time values using the Mysql backend

Diesel relies on libmysqlclient for interacting with Mysql compatible databases. This library requires to provide date/time values according to the byte layout of their MYSQLTIME type. Diesel replicated this type as reprC struct, populated all the fields of this struct and then casted this value ...

PT-2026-40741

Diesel relies on libmysqlclient for interacting with Mysql compatible databases. This library requires to provide date/time values according to the byte layout of their MYSQL TIME type. Diesel replicated this type as reprC struct, populated all the fields of this struct and then casted this value...

PraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315)

The fix for CVE-2026-40315 added input validation to SQLiteConversationStore only. Nine sibling backends — MySQL, PostgreSQL, async SQLite/MySQL/PostgreSQL, Turso, SingleStore, Supabase, SurrealDB — pass tableprefix straight into f-string SQL. Same root cause, same code pattern, same exploitation...

CVE-2026-30849 MantisBT SOAP API has an authentication bypass vulnerability on MySQL

Mantis Bug Tracker MantisBT is an open source issue tracker. Versions prior to 2.28.1 running on MySQL family databases are affected by an authentication bypass vulnerability in the SOAP API, as a result of an improper type checking on the password parameter. Other database backends are not...

EUVD-2013-4438

Malware in sbrugna...

Exploit for SQL Injection in Dimdavid File_Provider

CVE-2025-4578 File Provider = 5.0.12 time-based blind - Parame...

DEBIAN-CVE-2014-7210

pdns specific as packaged in Debian in version before 3.3.1-1 creates a too privileged MySQL user. It was discovered that the maintainer scripts of pdns-backend-mysql grant too wide database permissions for the pdns user. Other backends are not affected...

Exploit for SQL Injection in Eniture Ltl_Freight_Quotes

CVE-2024-13485 LTL Freight Quotes – ABF Freight Edition = 5.6...

Exploit for CVE-2024-12270

CVE-2024-12270 Beautiful Taxonomy Filters = 5.1 AND string err...

Exploit for SQL Injection in Quantumcloud Wpbot

CVE-2023-5204 AI ChatBot = 4.8.9 - Unauthenticated SQL Inj...

SUSE CVE-2014-5251

The MySQL token driver in OpenStack Identity Keystone 2014.1.x before 2014.1.2.1 and Juno before Juno-3 stores timestamps with the incorrect precision, which causes the expiration comparison for tokens to fail and allows remote authenticated users to retain access via an expired token...