django-connector-CVE-2025-64459-testbed

Django-CVE-2025-64459-Testbed A self-contained testbed for Django CVE-2025-64459. Demonstrates QuerySet.filter parameter injection via dictionary expansion using Docker. About the Vulnerability CVE-2025-64459 is a high-severity vulnerability in Django specifically versions 5.1.14 that allows...

GHSA-R223-96JV-Q533 JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort

SQL Injection in the sort Parameter of JHipster-Generated Reactive WebFlux + R2DBC Applications - Product: jhipster/generator-jhipster npm package generator-jhipster - Affected versions: v7.0.0 through v9.2.0 - Component: generated reactive-application code, template EntityManagerreactive.java.ej...

CVE-2026-107375 JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request paramete...

CVE-2026-107375

Applications generated using JHipster (versions 7.0.0 through 9.4.0) are vulnerable to SQL Injection when using Spring WebFlux , Spring Data R2DBC , and a SQL database. The vulnerability exists because the sort request parameter from paginated entity-list endpoints is passed into the createOrderB...

CVE-2026-107375 JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request paramete...

HotelDruid-CVE-2021-42948

CVE-2021-42948 HotelDruid Hotel Management Software v3.0.3 and below was discovered to have exposed session tokens in multiple links via GET parameters, allowing attackers to access user session id's. The session token used to access authenticated pages of the application is passed using GET...

CVE-2026-2058-PoC

CVE-2026-2058-PoC – CloudClassroom PHP Project SQL Injection Overview A SQL Injection vulnerability exists in the Post Query functionality of the CloudClassroom PHP Project v1.0. The vulnerability allows attackers to inject arbitrary SQL commands via the squeryx POST parameter, leading to databas...

exploit-CVE-2026-2670

exploit-CVE-2026-2670 CVE-2026-2670 – Advantech WISE-6610 Command Injection PoC Proof-of-concept exploit demonstrating a command injection vulnerability in the Advantech WISE-6610 industrial cellular router. The vulnerability exists in the /cgi-bin/luci/admin/openvpnapply endpoint and allows an...

CVE-2021-31805

CVE-2021-31805 PoC for CVE-2021-31805 Apache Struts2 This is the application used in the CVE-2021-31805 explanation article. Setup $ docker-compose build $ docker-compose up -d Verification Access http://localhost:8080/struts2-showcase-2.5.29/index.html and confirm that the Welcome page is...

CVE-2026-7229-SQLI

Authenticated SQL Injection in Coaching Management System Allows Database Dump Description A SQL Injection vulnerability exists in the Coaching Management System in PHP. The complaintreply parameter in the admin reply functionality is not properly sanitized before being used in SQL queries. An...

CVE-2026-7028-SQLI

CodeAstro-Online-Job-Portal-SQLi-Delete-All Details Vendor: CodeAstro Product: Online Job Portal Project in PHP MySQL Version: 1.0 Vulnerability Type: SQL Injection CWE: CWE-89 Affected Endpoint: /admin/jobs-admins/delete-jobs.php Parameter: id GET Impact: Allows deletion of all job records in th...

CVE-2026-6183-SQLI

SQL Injection via id Parameter in index.php - Simple Content Management System in PHP Description A SQL Injection vulnerability exists in Simple Content Management System PHP. The id parameter in index.php is not sanitized before being passed to the SQL query, allowing an unauthenticated attacker...

CVE-2026-6182-SQLI-auth

Bypass dell'Autenticazione tramite SQL Injection - Simple Content Management System PHP Descrizione Esiste una vulnerabilità di SQL Injection nella pagina di login dell'amministratore di Simple Content Management System PHP. Il parametro user non viene sanitizzato prima di essere passato alla que...

cve-2026-32699-facturascripts-nick-bypass

CVE-2026-32699 - FacturaScripts EditUser Nick Parameter Broken Access Control Description Summary The application fails to validate the nick parameter during a POST request to the EditUser controller. Although the UI prevents editing this field, a user can bypass this restriction using a proxy to...

CVE-2026-22557-PoC

CVE-2026-22557 -- UniFi Network Application Pre-Auth Path Traversal Pre-authenticated path traversal in the UniFi Network Application guest portal /guest/s/site/login. The pageerror query parameter is passed to a resource loader without validation, allowing an unauthenticated attacker to read fil...

CVE-2024-11613-wp-file-upload

CVE-2024-11613-wp-file-upload Exploit by Chirag Artani https://3rag.com for CVE-2024-11613 in WordPress File Upload Here is information - The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion in all versions up to,...

CVE-2026-6227

CVE-2026-6227: Local File Inclusion in BackWPup Advisory Summary BackWPup versions up to and including 5.6.6 are affected by an authenticated Local File Inclusion LFI vulnerability via the blockname parameter of the /wp-json/backwpup/v1/getblock REST endpoint. The flaw was caused by non-recursive...

CVE-2023-51810

CVE-2023-51810 Description Blind SQL injection vulnerability in StackIdeas EasyDiscuss v.5.0.5 allows a remote attacker to obtain sensitive information via search parameter in the Users module. Product StackIdeas EasyDiscuss v5.0.5 - EasyDiscuss - Joomla Forum Discussion Tool - StackIdeas...

CVE-2026-31844

Koha CVE-2026-31844: Authenticated SQL Injection Overview This repository contains a responsible vulnerability POC for CVE-2026-31844 , a high severity authenticated SQL injection vulnerability in the Koha Library Management System. The vulnerability exists in the GetDistinctValues function in...

CVE-2025-56381

CVE-2025-56381 — Authenticated SQL Injection in ERPNext / Frappe via orderby and groupby Parameters 📌 Summary ERPNext v15.67.0 and Frappe Framework v15.72.4 contain multiple authenticated SQL injection vulnerabilities in the frappe.desk.reportview.get API endpoint. Malicious input to the orderby ...