EverShop-Lab-CVE-2026-25993

CVE-2026-25993 — EverShop二阶SQL注入实验室 前提条件 Docker Engine 24+ 及 Docker Compose v2+ 2 GB 可用内存 部署 cd EverShop-Lab/ docker compose up 首次构建需要等待约2分钟（克隆EverShop v2.1.0，编译，运行迁移，填充数据）。 应用将在 http://localhost:3000 可用。 凭据 字段| 值 ---|--- 管理员邮箱| [email protected] 管理员密码| password123 停止/重置 Stop the lab keep da...

POC-AIOWPM-CVE-2026-19949

CVE-2026-19949 — Prueba de concepto documentada y reproducible en Docker Inyección SQL de segundo orden no autenticada en All-in-One WP Migration and Backup WordPress que escala a filtrado de la ai1wmsecretkey y, con ella, a ejecución remota de código RCE. Lee esto en: English · Español | ---|---...

CVE-2026-101268

CVE-2026-101268 describes a customer session fixation vulnerability. An attacker can use a specially crafted link to trick a victim into logging into the attacker's customer account. If successful, the victim's order details may be stored within the attacker's account. This attack is specifically...

CVE-2026-101268 Customer session fixation

If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to the attacker's customer account. If the victim does not notice this, this might lead to their order details being stored into the attacker's account. The attack only works when the event is availab...

CVE-2026-101268 Customer session fixation

If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to the attacker's customer account. If the victim does not notice this, this might lead to their order details being stored into the attacker's account. The attack only works when the event is availab...

CVE-2025-68999-POC

CVE-2025-68999 Happy Addons for Elementor prepare 安全地获取行，但随后将 $entry-metakey 直接插入 SQL 字符串而不进行转义： $records = " $duplicatedpostid, '$entry-metakey', '$value' "; // ... $wpdb-query $query ; 由于 metakey 来自数据库，代码将其视为可信。但贡献者可以通过自定义字段面板设置任意字段名称——因此他们控制该列中的内容。 攻击分为两步： 1. 写入： 将恶意字符串存储为自定义字段名称。addpostmeta...

CVE-2025-68999-POC

CVE-2025-68999 Happy Addons for Elementor prepare, pero luego inserta $entry-metakey directamente en la cadena SQL sin escaparla: $records = " $duplicatedpostid, '$entry-metakey', '$value' "; // ... $wpdb-query $query ; Dado que metakey proviene de la base de datos, el código lo trata como...

CVE-2026-102363 mall4j through 4.0 Unauthenticated Shipment Tracking Disclosure via Order Number

mall4j through 4.0 contains a missing authentication vulnerability in the DeliveryController checkDelivery endpoint that allows unauthenticated attackers to read shipment tracking information by supplying an order number parameter. Attackers can access carrier names, waybill numbers, and complete...

CVE-2026-102363

The mall4j framework (versions through 4.0 ) is vulnerable to an unauthenticated shipment tracking disclosure. The flaw exists in the DeliveryController checkDelivery endpoint, where a missing authentication check allows attackers to retrieve shipment tracking information by providing an order nu...

CVE-2026-102363 mall4j through 4.0 Unauthenticated Shipment Tracking Disclosure via Order Number

mall4j through 4.0 contains a missing authentication vulnerability in the DeliveryController checkDelivery endpoint that allows unauthenticated attackers to read shipment tracking information by supplying an order number parameter. Attackers can access carrier names, waybill numbers, and complete...

CVE-2026-102363 mall4j through 4.0 Unauthenticated Shipment Tracking Disclosure via Order Number

mall4j through 4.0 contains a missing authentication vulnerability in the DeliveryController checkDelivery endpoint that allows unauthenticated attackers to read shipment tracking information by supplying an order number parameter. Attackers can access carrier names, waybill numbers, and complete...

Incorrect Behavior Order

Overview ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Incorrect Behavior Order via the isLinkLocal method, which incorrectly compared only the first 64 bits of an IPv6 address against the fixed patte...

Incorrect Behavior Order

Overview org.webjars.npm:ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Incorrect Behavior Order via the isLinkLocal method, which incorrectly compared only the first 64 bits of an IPv6 address against...

CVE-2026-101110

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library Free quote instead of rejecting it. The value is then concatenated directly into an unquoted ORDER BY clause, a position where quoting provides no protection at all. Reaching the vulnerable code path requires two...

CVE-2026-101108

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager Free 6.5.8 - site/vehiclemanager.php reads the orderfield and orderdirection sort parameters at three separate anonymous-reachable frontend entry points category listing, search, and the all-vehicles listing throug...

EUVD-2026-88436

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library Free quote instead of rejecting it. The value is then concatenated directly into an unquoted ORDER BY clause, a position where quoting provides no protection at all. Reaching the vulnerable code path requires two...

CVE-2026-101110 Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6.4.6

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library Free quote instead of rejecting it. The value is then concatenated directly into an unquoted ORDER BY clause, a position where quoting provides no protection at all. Reaching the vulnerable code path requires two...

CVE-2026-101110

The Book Library (Free) Joomla Extension by ordasoft.com (versions

CVE-2026-101110 Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6.4.6

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library Free quote instead of rejecting it. The value is then concatenated directly into an unquoted ORDER BY clause, a position where quoting provides no protection at all. Reaching the vulnerable code path requires two...

CVE-2026-101108

The Vehicle Manager (Free) Joomla extension by ordasoft.com is vulnerable to an unauthenticated SQL Injection in versions prior to 6.5.8 . The flaw exists in site/vehiclemanager.php, where the order_field and order_direction parameters are processed at three frontend entry points (category listin...