88 matches found
msploitego
msploitego - Maltego를 위한 침투 테스트 스위트 이것은 베타 릴리스입니다. 문제가 있으면 보고해 주세요. 새로운 기능 새로운 기능 이제 Postgres 쿼리를 통해 Metasploit의 여러 작업공간 지원 대상에 대해 수많은 보조 모듈을 실행하는 bash 스크립트. Metasploit DB를 실제로 '비대하게' 만듬 변환: Metasploit 작업공간 열거 Nikto 파서 파일에서 Enum4linux 파서 파일에서 DNS 스캔 버그 수정 nmap 기반 변환의 거짓 음성 반환 잘못된 경로 msploitego는...
Mortimer
Mortimer Una raccolta di script per l'elaborazione di dati e intelligence di tipo network forensics, principalmente in un database postgres. Rilasciato come open source da NCC Group Plc - http://www.nccgroup.com/ Sviluppato per John Green, cirt at nccgroup dot com...
CVE-2026-48528
CVE-2026-48528 affects Metacat versions 2.0.0–3.4.0 and describes an unauthenticated SQL injection in the /cn/v1/object and /cn/v2/object REST endpoints due to unsanitized nodeId input. The backend SQL queries concatenate user input, enabling arbitrary data extraction from PostgreSQL and potentia...
CVE-2026-71276 Magistrala (formerly Mainflux) IoT Platform SQL Injection via format Query Parameter
Magistrala formerly Mainflux's message-readers API reads a value from the HTTP query string readers/api/http/transport.go with no validation and interpolates it directly into raw SQL queries via fmt.Sprintf in both the PostgreSQL reader readers/postgres/messages.go: and the TimescaleDB reader...
CVE-2026-49498
Ghidra 11.0 before 12.1 contains a SQL injection vulnerability in the changePassword method of PostgresFunctionDatabase that fails to escape double quotes in usernames interpolated into ALTER ROLE statements. Authenticated attackers can inject SQL commands via crafted username parameters in...
CVE-2026-45288
Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. Prior to 8.36.1, Marten's full-text search APIs interpolated the user-supplied regConfig parameter directly into the generated SQL without parameterization or validation, making every code path that exposes regConfig to...
Attackers Use LLM Agent for Post-Exploitation After Marimo CVE-2026-39987 Exploit
An unknown threat actor has been observed using a large language model LLM agent to conduct post-compromise actions after obtaining initial access following the exploitation of a publicly-accessible Marimo network using a recently disclosed vulnerability. "The attacker compromised an...
drupal-sa-core-2026-004-lab
SA-CORE-2026-004 — Lab, PoC, and Post-mortem Drupal core SQ...
CVE-2026-46445
SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection...
GHSA-6J7P-QJHG-9947 Rucio has SQL Injection in FilterEngine PostgreSQL Query Builder via DID Search API
Summary A SQL injection vulnerability in FilterEngine.createpostgresquery allows any authenticated Rucio user to execute arbitrary SQL against the configured PostgreSQL metadata database through the DID search endpoint GET /dids//dids/search. When the external metadata plugin postgresmeta is...
CVE-2026-40906
A flaw was found in ElectricSQL, a Postgres sync engine. An authenticated user could exploit an error-based SQL injection vulnerability in the /v1/shape API's orderby parameter. This flaw allows an attacker to read, write, and destroy the full contents of the underlying PostgreSQL database. Such ...
OpenBao SQL注入漏洞
OpenBao is an open-source sensitive data management software developed by OpenBao. Versions of OpenBao prior to 2.5.3 had a SQL injection vulnerability. This vulnerability occurred when revoking role permissions in the PostgreSQL database key engine, where the correct database reference was not...
SQL Injection
Overview @langchain/google-cloud-sql-pg is a LangChain.js integrations for Google Cloud SQL for PostgreSQL Affected versions of this package are vulnerable to SQL Injection via the PostgresChatMessageHistory.initialize method due to the improper parameters validation before incorporating them int...
CVE-2026-29953
SQL Injection vulnerability in SchemaHero 0.23.0 via the column parameter to the columnAsInsert function in file plugins/postgres/lib/column.go...
Parse Server has SQL Injection through aggregate and distinct field names in PostgreSQL adapter
Impact An attacker with master key access can execute arbitrary SQL statements on the PostgreSQL database by injecting SQL metacharacters into field name parameters of the aggregate $group pipeline stage or the distinct operation. This allows privilege escalation from Parse Server application-lev...
CVE-2026-32248 Parse Server: Account takeover via operator injection in authentication data identifier
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.12 and 8.6.38, an unauthenticated attacker can take over any user account that was created with an authentication provider that does not validate the format of the user...
WeKnora Vulnerable to Remote Code Execution via SQL Injection Bypass in AI Database Query Tool
Summary A critical Remote Code Execution RCE vulnerability exists in the application's database query functionality. The validation system fails to recursively inspect child nodes within PostgreSQL array expressions and row expressions, allowing attackers to bypass SQL injection protections. By...
Input Validation Bypass
Apache Superset is vulnerable to Input Validation Bypass. The vulnerability is due to specially crafted SQL statements can bypass the read-only verification check when using a PostgreSQL database connection, and attackers can exploit it to execute unauthorized actions...
📄 Advantech IoTSuite / IoT Edge SQL Injection
A critical unauthenticated SQL injection vulnerability was identified in Advantech WISE-IoTSuite / SaaS Composer. The issue resides in the /displays/filename.json endpoint, where the filename parameter is improperly sanitized before being concatenated into a backend PostgreSQL query. An attacker...
