CVE-2025-26794

CVE-2025-26794: Inyección SQL ciega en Exim 4.98 SQLite DBM - writeup del exploit Informe de Exim: https://www.exim.org/static/doc/security/CVE-2025-26794.txt Descubrí esta vulnerabilidad mediante una revisión manual del código. Detalles de la vulnerabilidad: Problema Los parámetros SQL, cuando s...

CVE-2021-33959

CVE-2021-33959 Se puede ver que el servicio de Plex escucha en los cuatro puertos UDP 32410, 32412, 32413 y 32414. Mediante el análisis de la carga útil del ataque y utilizando el formato de mensaje de la solicitud de consulta de dispositivo como referencia, escribimos software para enviar paquet...

CVE-2026-12267

ManageEngine DDI Central versions below 6201 are vulnerable to Command injection in Windows DNS Query Resolution Policy name field leading to remote code execution...

EUVD-2026-88215

ManageEngine DDI Central versions below 6201 are vulnerable to Command injection in Windows DNS Query Resolution Policy name field leading to remote code execution...

CVE-2026-12267 Authenticated PowerShell Injection in DNS Query Resolution Policy leads to RCE

ManageEngine DDI Central versions below 6201 are vulnerable to Command injection in Windows DNS Query Resolution Policy name field leading to remote code execution...

CVE-2026-12267

ManageEngine DDI Central versions below 6201 are vulnerable to Command injection within the Windows DNS Query Resolution Policy name field. This flaw can lead to remote code execution (RCE). No specific exploit details or in-the-wild exploitation information are provided in the documents. Remedia...

CVE-2026-12267 Authenticated PowerShell Injection in DNS Query Resolution Policy leads to RCE

ManageEngine DDI Central versions below 6201 are vulnerable to Command injection in Windows DNS Query Resolution Policy name field leading to remote code execution...

CVE-2019-0232

CVE-2019-0232 Apache Tomcat CGIServlet enableCmdLineArguments RCE Inyección en scripts batch de Windows mediante argumentos de la cadena de consulta Descripción Apache Tomcat con el servlet CGI habilitado y enableCmdLineArguments=true pasa los parámetros de la cadena de consulta como argumentos d...

CVE-2023-26256

CVE-2023-26256POC fofa:body="JIRA"&&body="2.0.50" Usage: python3 CVE-2023-26256.py -h Descargo de responsabilidad Cualquier consecuencia o pérdida directa o indirecta causada por la difusión o el uso de la información proporcionada en este documento será responsabilidad exclusiva del usuario. El...

BIT-MONGODB-2026-18711 Use-After-Free in MongoDB Query Execution Engine Leads to Denial of Service and Potential Memory Disclosure

An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to cause an internal reference to be used after the underlying memory has been freed, when running certain queries against time-series collections. This could result in a server...

CVE-2026-27886-check

Herramienta de Evaluación de Vulnerabilidad CVE-2026-27886 Detecte de forma segura si una instancia de Strapi es vulnerable a CVE-2026-27886 sin realizar la cadena completa de apropiación de cuentas. Consulte el artículo completo en el blog de Bishop Fox. Descripción CVE-2026-27886 es un bypass d...

Joomla! Component Zh BaiduMap 3.0.0.1 - SQL Injection

SQL Injection exists in the Zh BaiduMap 3.0.0.1 component for Joomla! via the id parameter in a getPlacemarkDetails, getPlacemarkHoverText, getPathHoverText, or getPathDetails request. id: CVE-2018-6605 info: name: Joomla! Component Zh BaiduMap 3.0.0.1 - SQL Injection author: DhiyaneshDk severity...

IBM BigFix Platform - Information Disclosure

IBM BigFix Platform 9.2 and 9.5 contains an information disclosure vulnerability caused by not enabling authenticated access in relay, letting remote attackers query and gather update and fixlet information, exploit requires no authentication. id: CVE-2019-4061 info: name: IBM BigFix Platform -...

CVE-2017-16082

CVE-2017-16082 Descripción general Las versiones afectadas de pg contienen una vulnerabilidad de ejecución remota de código que ocurre cuando la base de datos remota o la consulta especifica un nombre de columna manipulado. Existen dos escenarios específicos en los que es probable que una...

EUVD-2026-88051

A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System up to 81bf0b55f5933f3b0dbb1583204a612e06605b95. The impacted element is the function orderby of the file DBquerybuilder.php of the component Database Query Builder. Performing a manipulation of the argumen...

CVE-2026-100887

A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System up to 81bf0b55f5933f3b0dbb1583204a612e06605b95. The impacted element is the function orderby of the file DBquerybuilder.php of the component Database Query Builder. Performing a manipulation of the argumen...

CVE-2026-12267: Improper Input Validation

ManageEngine DDI Central versions below 6201 are vulnerable to Command injection in Windows DNS Query Resolution Policy name field leading to remote code execution...

CVE-2026-100753: Improper Neutralization of Input During Web Page Generation

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager Free 6.7.9 - The public property-detail page’s “leave a review” form repopulates its title field directly from the request with no escaping and no filtering function of any kind, unlike the adjacent comment...

CVE-2026-101144: Improper Access Control

A vulnerability was determined in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/searchAction.do of the component Query Builder. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The exploit has been publicly...

CVE-2026-90979: Improper Neutralization of Special Elements used in an LDAP Query

LDAPCache and LDAPBackingEngine build LDAP search filters for user lookup and role lookup by textually substituting the placeholders %u, %dn, and %fqdn drawn from the login name, the resolved user DN, and its fully qualified namespace form into administrator-configured filter templates...