CVE-2026-49772

The Events Calendar ثغرة حقن SQL CVE-2026-49772 PoC الوصف CVE-2026-49772 هي حقن SQL أعمى بدون مصادقة في إضافة ووردبريس The Events Calendar. يسمح مُتحقق معامل REST معطوب validatecallback يعيد إغلاقًا بدلاً من التحقق بوصول معامل order في واجهة REST التجريبية tec/v1 إلى جملة SQL ORDER BY دون تنقية:...

CVE-2026-65761

CVE-2026-65761 — Injection SQL EasyStore Joomla sans authentification Direction filtersortby → Injection ORDER BY → Lecture complète de la base de données Vue d'ensemble CVE-2026-65761 CVSS 9.3 Critique est une injection SQL non authentifiée dans EasyStore pour Joomla de JoomShaper, affectant les...

XWiki Platform - SQL Injection

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an...

CVE-2022-37201

CVE-2022-37201 CVE-2022-37201 POC إثبات المفهوم أولاً، يجب عليك تثبيت sqlmap تحتاج إلى تعيين النطاق المستهدف أو عنوان IP ملف تعريف الارتباط الخاص بك ثم قم بتشغيل الأمر root@kitploit: sqlmap -u http://targetDomainOrIP/jfinalcms/jfinalcms/admin/contact/list --thread 8 --batch --smart --random-agent...

CVE-2026-42647-Lab

CVE-2026-42647 - حقن SQL أعمى قائم على الوقت بدون مصادقة في JoomSport عبر sortf ملخص تنفيذي يحتوي هذا المستودع على بيئة مختبر Docker محلية لإعادة إنتاج والتحقق من صحة CVE-2026-42647، وهي ثغرة حقن SQL بدون مصادقة تؤثر على إضافة WordPress JoomSport - للرياضات: الفريق والدوري، كرة القدم، الهوكي،...

EUVD-2026-71620

ILIAS before versions 9.22, 10.10, and 11.3 contains a SQL injection vulnerability in the repository trash table where the table navigation sort field from HTTP requests is passed directly into the ORDER BY clause of a SQL query without validation against declared sortable columns. Authenticated...

CVE-2026-78070

Injection SQL via Shortcode ORDER BY dans plgcontentdpcalendar DPCalendar Free ≤ 10.11.2 — Un utilisateur de niveau Auteur extrait l'intégralité de la base de données via une injection aveugle basée sur le temps RÉSUMÉ Le plugin de contenu plgcontentdpcalendar analyse les shortcodes events...

CVE-2026-85388

Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowing authenticated users to inject arbitrary PostgreSQL expressions into ORDER BY clauses. Attackers can use time-based and boolean-based blind SQL injection techniques to extract...

CVE-2026-85388 Worklenz through 3.0.0 SQL Injection via the sort-field Query Parameter

Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowing authenticated users to inject arbitrary PostgreSQL expressions into ORDER BY clauses. Attackers can use time-based and boolean-based blind SQL injection techniques to extract...

EUVD-2026-70665

Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowing authenticated users to inject arbitrary PostgreSQL expressions into ORDER BY clauses. Attackers can use time-based and boolean-based blind SQL injection techniques to extract...

CVE-2026-85388

Worklenz through 3.0.0 is vulnerable to blind SQL injection via the sort-field query parameter in pagination helper functions. The root cause is improper validation that allows authenticated users to inject arbitrary PostgreSQL expressions into ORDER BY clauses. Attackers can leverage time-based ...

CVE-2026-1581-Analysis-Lab

CVE-2026-1581 — wpForo Forum = 2.4.14 Injection SQL basée sur le temps non authentifiée ORDER BY ภาษาไทย Résumé Exécutif...

CVE-2026-25513

CVE-2026-25513 : FacturaScripts a une injection SQL dans la clause ORDER BY de l'API Aperçu...

CVE-2026-77823

The LearnPress WordPress plugin (versions ≤ 4.4.4 ) is vulnerable to SQL injection via the orderby parameter in the export_order_csv AJAX action. The root cause is insufficient escaping: only the literal values date and title are normalized, while any other attacker-controlled string is concatena...

CVE-2026-63039

CVE-2026-63039 — Apache InLong AuditAlertRule : injection SQL dans ORDER BY Reproducteur exécutable de type proof-of-concept pour l'injection SQL dans la requête audit-alert-rule d'Apache InLong. Le mapper du manager InLong AuditAlertRuleEntityMapper.selectByCondition filtre avec des paramètres...

CVE-2026-74820

CVE-2026-74820 is a CRITICAL (CVSS 4.0: 10.0) SQL injection vulnerability in the ServiceNow AI platform , specifically through a Dynamic Schema ORDER BY clause . An unauthenticated user can, under certain circumstances, execute arbitrary SQL statements against the instance's underlying database, ...

CVE-2026-74820 Unauthenticated SQL Injection via Dynamic Schema ORDER BY Clause

ServiceNow has remediated a SQL injection vulnerability that was identified in in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gain access to, or...

CVE-2026-46371

Fleet (open-source device management platform built on osquery) versions up to 4.84.1 have a vulnerability in the Apple MDM commands endpoint (GET /api/v1/fleet/mdm/apple/commands). An unvalidated user-supplied order_key parameter, passed to a deprecated ORDER BY helper that joins the hosts and n...

CVE-2026-46371 Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint

Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the Apple MDM commands listing endpoint GET /api/v1/fleet/mdm/apple/commands allowed an authenticated user with the lowest-privilege Observer role to extract sensitive values from joined...

CVE-2026-46371 Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint

Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the Apple MDM commands listing endpoint GET /api/v1/fleet/mdm/apple/commands allowed an authenticated user with the lowest-privilege Observer role to extract sensitive values from joined...