CVE-2018-25183

Shipping System CMS 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to bypass authentication by injecting SQL code through the username parameter. Attackers can submit malicious SQL payloads using boolean-based blind techniques in POST requests to the admin login...

ThreatsDay Bulletin: PQC Push, AI Vuln Hunting, Pirated Traps, Phishing Kits & 20 More Stories

Some weeks in security feel loud. This one feels sneaky. Less big dramatic fireworks, more of that slow creeping sense that too many people are getting way too comfortable abusing things they probably shouldn’t even be touching. There’s a little bit of everything in this one, too. Weird delivery...

CVE-2018-25209

OpenBiz Cubi Lite 3.0.8 contains a SQL injection vulnerability in the login form that allows unauthenticated attackers to manipulate database queries through the username parameter. Attackers can submit POST requests to /bin/controller.php with malicious SQL code in the username field to extract...

CVE-2018-25209 OpenBiz Cubi Lite 3.0.8 SQL Injection via username Parameter

OpenBiz Cubi Lite 3.0.8 contains a SQL injection vulnerability in the login form that allows unauthenticated attackers to manipulate database queries through the username parameter. Attackers can submit POST requests to /bin/controller.php with malicious SQL code in the username field to extract...

CVE-2018-25206 KomSeo Cart 1.3 SQL Injection via edit.php

KomSeo Cart 1.3 contains an SQL injection vulnerability that allows attackers to inject SQL commands through the 'myitemsearch' parameter in edit.php. Attackers can submit POST requests with malicious SQL payloads to extract sensitive database information using boolean-based blind or error-based...

CVE-2018-25207

Online Quiz Maker 1.0 is affected by SQL injection in the catid and usern parameters. The issue allows authenticated attackers to submit crafted SQL payloads via POST requests to quiz-system.php or add-category.php, potentially extracting sensitive data or bypassing authentication. The vulnerabil...

CVE-2018-25202

SAT CFDI 3.3 is affected by an SQL injection in the signIn endpoint via the id parameter. The vulnerability allows attackers to manipulate queries using boolean-based blind, stacked, or time-based blind payloads to extract data or compromise the application. Public metrics indicate high severity ...

CVE-2018-25202 SAT CFDI 3.3 SQL Injection via signIn endpoint

SAT CFDI 3.3 contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the 'id' parameter in the signIn endpoint. Attackers can submit POST requests with boolean-based blind, stacked queries, or time-based blind SQL injection payloa...

CVE-2018-25195

Wecodex Hotel CMS 1.0 contains an SQL injection vulnerability in the admin login functionality that allows unauthenticated attackers to bypass authentication by injecting SQL code. Attackers can submit malicious SQL payloads through the username parameter in POST requests to index.php with...

CVE-2018-25195

CVE-2018-25195 describes an SQL injection vulnerability in Wecodex Hotel CMS 1.0, specifically in the admin login functionality. The issue allows unauthenticated attackers to bypass authentication by injecting SQL code via the username parameter in POST requests to index.php?action=processlogin, ...

CVE-2026-4862

creationtimestamp| type| source ---|---|--- 2026-03-26 10:40:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhxg3ige7z2d 2026-03-27 00:00:42+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhysskofyy2w...

CVE-2026-33936

creationtimestamp| type| source ---|---|--- 2026-03-26 09:59:25+00:00| published-proof-of-concept| https://github.com/tlsfuzzer/python-ecdsa/security/advisories/GHSA-9f5j-8jwj-x28g 2026-03-28 02:39:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mi3m65n3lp2n 2026-04-02...

CVE-2026-4847

creationtimestamp| type| source ---|---|--- 2026-03-26 09:54:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhxdk5iwkr2d...

CVE-2025-15488

creationtimestamp| type| source ---|---|--- 2026-03-26 09:05:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhxar3brtl23...

CVE-2026-4838

creationtimestamp| type| source ---|---|--- 2026-03-26 06:43:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhwytil3tk2s...

CVE-2026-1986

creationtimestamp| type| source ---|---|--- 2026-03-26 05:57:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhwwau2siz27...

CVE-2026-2931

creationtimestamp| type| source ---|---|--- 2026-03-26 05:18:18+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhwu3lmmly27 2026-03-26 05:59:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhwwejqr3y25 2026-03-26 07:00:50+00:00| seen|...

CVE-2026-4331

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to unauthorized data loss in all versions up to, and including, 8.8.2. This is due to the resetSocialMetaTags function only verifying that the user has the 'read' capability and a valid b2ssecuritynonce, both o...

CVE-2026-3328

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to PHP Object Injection via deserialization of the 'postcontent' of adminform posts in all versions up to, and including, 3.28.31. This is due to the use of WordPress's maybeunserialize function without class restrictions on...

CVE-2026-4331 Blog2Social: Social Media Auto Post & Scheduler <= 8.8.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Deletion via 'b2s_reset_social_meta_tags' AJAX Action

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to unauthorized data loss in all versions up to, and including, 8.8.2. This is due to the resetSocialMetaTags function only verifying that the user has the 'read' capability and a valid b2ssecuritynonce, both o...