sqlite-xfer-auth

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · sqlite-xfer-auth sqlite-xfer-auth Class: Privilege leftover Reach: Local SQLite 3.53.4 b09c88c, SOURCEID 2026-07-24 19:02:57 bf7c7f30031888f4e796e429ab3978879485813aaca6f641c7b33e4e09459bcc still takes the...

CVE-2026-15748

CVE-2026-15748 — Forminator Forms Unauthenticated Arbitrary File Upload → RCE CVSS 9.8 Critical · Affected: Forminator = 1.56.1 · Patched: 1.56.2 Researcher: daroo Wordfence Bug Bounty, $2,048 · 600k active installs Writeup:...

CVE-2022-28346

CVE-2022-28346 Django QuerySet.annotate, aggregate, extra SQL Injection Environment Initialization 1.python manage.py makemigrations 2.python manage.py migrate 3.访问http://x.x.x.x:8000/ 插入初始化数据 Vulnerability Reproduction 访问http://x.x.x.x:8000/demo POC: http://x.x.x.x:8000/demo?field=demo.name" FRO...

WordPress Select All Categories and Taxonomies <1.3.2 - Cross-Site Scripting

WordPress Select All Categories and Taxonomies plugin before 1.3.2 contains a cross-site scripting vulnerability. The settings page of the plugin does not properly sanitize the tab parameter before outputting it back. An attacker can inject arbitrary script in the browser of an unsuspecting user ...

CVE_2018_16763_Proof_of_Concept

CVE-2018-16763 Proof-of-Concept A Proof-of-Concept PoC exploit for CVE-2018-16763 Fuel CMS - Preauthenticated Remote Code Execution. Description This Python 3 program serves as a PoC for the CVE-2018-16763 vulnerability in the Fuel CMS content management system. Specifically, the vulnerability...

CVE-2026-65321-pyathena

CVE-2026-65321: SQL Injection in PyAthena via Backslash Quote-Escaping for Non-SELECT Statements Severity: Critical, CVSS v4.0 9.3 / CVSS v3.1 9.8 assigned by VulnCheck, the CNA Vector v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Vector v3.1:...

CVE-2026-32710

CVE-2026-32710 Heap buffer overflow in MariaDBJSONSCHEMAVALID → persistent privilege escalation → UDF RCE | ---|--- Affected| MariaDB 11.4.x confirmed on 11.4.9 Bug| OOB write in jsongetnormalizedstring — strncpy into 128-byte DYNAMICSTRING with no bounds check Impact| SELECT-only user → ALL...

BUI-select-xss

BUI-select-xss cve-2018-8108 During a security test, this issue was discovered by chance. BUI is a front-end framework used by many enterprises to build their own front-end applications. Typically, we prevent XSS by treating all user input as untrusted, escaping it during output, and then passing...

CVE-2026-112145 speaches-ai speaches Pyannote Diarization Model Loading pyannote_diarization.py PyannoteDiarizationModelManager._load_fn externally-controlled input to select classes or code

A security vulnerability has been detected in speaches-ai speaches up to 0.9.0-rc.3. This vulnerability affects the function PyannoteDiarizationModelManager.loadfn of the file src/speaches/executors/pyannotediarization.py of the component Pyannote Diarization Model Loading. The manipulation of th...

CVE-2026-112145: Use of Externally-Controlled Input to Select Classes or Code

A security vulnerability has been detected in speaches-ai speaches up to 0.9.0-rc.3. This vulnerability affects the function PyannoteDiarizationModelManager.loadfn of the file src/speaches/executors/pyannotediarization.py of the component Pyannote Diarization Model Loading. The manipulation of th...

PT-2026-117029

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix slab-out-of-bounds read in ieee80211 monitor select queue ieee80211 monitor select queue validates the skb length using skb-len before dereferencing pointers into skb-data to access the 802.11 header. However,...

CVE-2026-29187_SqlInjectionVulnerabilityOpenEMR7.0.4

CVE-2026-29187 - SQL Injection Vulnerability in new search popup Weakness CWE-89 Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not...

Astra Linux – Vulnerability in Firefox, Thunderbird

An attacker could cause a select dropdown menu to be displayed over another tab; this could lead to user confusion and potential spoofing attacks. This vulnerability affects Firefox 133, Firefox ESR 128.5, Thunderbird 133, and Thunderbird 128.5...

Astra Linux – Vulnerability in SQLite3

The flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN where the right-hand side is a view. This can lead to a NULL pointer dereference or incorrect results...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: tools/power/x86/intel-speed-select: Harden daemon pidfile opening Avoid clobbing of pidfile files based on symlinks by opening the pidfile with ONOFOLLOW and validating it using fstat before locking/writing it. The daemon current...

Astra Linux – Vulnerability in xorg-server

A vulnerability was discovered in X.Org. This security flaw occurs because the handler for the XvdiSelectVideoNotify request may write to memory after it has been freed. This issue can lead to local privileges escalation on systems where X is used...

CVE-2026-109337

SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to infer field values hidden by field-level SELECT permissions using LIVE SELECT WHERE predicates over $before or $after. Attackers can craft repeated predicates and observe whether notifications are...

CVE-2026-109337 SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT WHERE Clause

SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to infer field values hidden by field-level SELECT permissions using LIVE SELECT WHERE predicates over $before or $after. Attackers can craft repeated predicates and observe whether notifications are...

EUVD-2026-97639

SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to infer field values hidden by field-level SELECT permissions using LIVE SELECT WHERE predicates over $before or $after. Attackers can craft repeated predicates and observe whether notifications are...

CVE-2026-109337

SurrealDB versions before 3.3.0 are vulnerable to an authorization bypass involving field-level SELECT permissions. This vulnerability allows record users to infer hidden field values by using LIVE SELECT WHERE predicates over $before or $after . By crafting and repeating specific predicates, an ...