CVE-2022-28346

CVE-2022-28346 Django QuerySet.annotate, aggregate, extra SQL 注入 环境初始化 1.python manage.py makemigrations 2.python manage.py migrate 3.访问http://x.x.x.x:8000/ 插入初始化数据 漏洞复现 访问http://x.x.x.x:8000/demo POC: http://x.x.x.x:8000/demo?field=demo.name" FROM "demouser" union SELECT "1",sqliteversion,"3" --...

CVE-2026-97342

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action in all versions up to, and including, 3.6.5.4 due to insufficient input sanitization and output escaping. This makes it possible...

EUVD-2026-91250

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action in all versions up to, and including, 3.6.5.4 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-97342 JetFormBuilder <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action in all versions up to, and including, 3.6.5.4 due to insufficient input sanitization and output escaping. This makes it possible...

WordPress Select All Categories and Taxonomies <1.3.2 - Cross-Site Scripting

WordPress Select All Categories and Taxonomies plugin before 1.3.2 contains a cross-site scripting vulnerability. The settings page of the plugin does not properly sanitize the tab parameter before outputting it back. An attacker can inject arbitrary script in the browser of an unsuspecting user ...

PT-2026-104150

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action in all versions up to, and including, 3.6.5.4 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-32710

CVE-2026-32710 MariaDBJSONSCHEMAVALID 中的堆缓冲区溢出 → 持久化权限提升 → UDF 远程代码执行 | ---|--- 受影响版本| MariaDB 11.4.x（已在 11.4.9 上确认） 漏洞| jsongetnormalizedstring 中的越界写入 — strncpy 写入 128 字节的 DYNAMICSTRING，无边界检查 影响| 仅具有 SELECT 权限的用户 → ALL PRIVILEGES WITH GRANT OPTION → 通过 UDF 执行任意命令 源码位置| sql/jsonschemahelper.cc:91...

CVE-2026-29187_SqlInjectionVulnerabilityOpenEMR7.0.4

CVE-2026-29187 - 新搜索弹出窗口中的SQL注入漏洞 弱点 CWE-89 SQL命令中特殊元素的未正确中性化处理（'SQL注入'） 产品使用来自上游组件的外界影响输入来构建SQL命令的全部或部分，但未能正确中性化或错误中性化可能改变预期SQL命令的特殊元素。如果没有对用户可控输入中的SQL语法进行充分的移除或转义，生成的SQL查询可能导致这些输入被解释为SQL而非普通用户数据。在MITRE上了解更多。 摘要 OpenEMR $value if !strstartswithstring $key, 'mf' continue; // "match field" $fldnam...

CVE-2026-15748

CVE-2026-15748 — Forminator Forms 未认证任意文件上传 → RCE CVSS 9.8（严重） · 受影响：Forminator = 1.56.1 · 已修复：1.56.2 研究人员：daroo（Wordfence 漏洞赏金计划，$2,048）· 约 60 万活跃安装 分析文章：wordfence.com/blog/2026/08/600000-wordpress-sites-affected-by-arbitrary-file-upload-vulnerability-in-forminator-forms-wordpress-plugin/ 根因链条...

CVE-2026-65321-pyathena

CVE-2026-65321：PyAthena 对非 SELECT 语句的反斜杠引号转义导致的 SQL 注入 严重性： 严重，CVSS v4.0 9.3 / CVSS v3.1 9.8 （由 CNA VulnCheck 分配） 向量（v4.0）： CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N 向量（v3.1）： CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 受影响版本： PyAthena = 3.35.3（直至 3.35.3 的所有版本） 修复版本： 3.35.4...

BUI-select-xss

BUI-select-xss cve-2018-8108 在一次安全测试中，偶然发现给问题 bui是一个前端框架，很多企业都在使用该框架构建自己的前端 通常我们防范xss的方法是会对用户输入统一按照不信任原则，在输出的时候进行转义，传递给前端页面进行展示 但是bui的select组件在展示这部分输出的时候，却将原本已经在转义好的用户输入又给转义了回去，造成xss的payload绕过了原有的安全机制，继续运行 附件中的例子来自于真实的案例 可以看到id为“workGroupList”的input标签中的数据已经做了转义，...

AlmaLinux 9.6 [TuxCare] Security Update: mariadb / mariadb-backup / mariadb-common / mariadb-devel / etc (ALMALINUX9.6:CLSA-2026:1784045832)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784045832 advisory. - MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to...

Rocky Linux 9.6 [TuxCare] Security Update: mariadb / mariadb-backup / mariadb-common / mariadb-devel / etc (ALMALINUX9.6:CLSA-2026:1784045832)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784045832 advisory. - MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 ...

AlmaLinux 9.2 [TuxCare] Security Update: mariadb / mariadb-backup / mariadb-common / mariadb-devel / etc (ALMALINUX9.2:CLSA-2026:1783515814)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1783515814 advisory. - MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to...

CVE_2018_16763_Proof_of_Concept

CVE-2018-16763 概念验证 针对 CVE-2018-16763（Fuel CMS - 未认证远程代码执行）的概念验证（PoC）利用程序。 描述 此 Python 3 程序作为 CVE-2018-16763 漏洞在 Fuel CMS 内容管理系统中的 PoC。具体而言，该漏洞允许通过 pages/select/filter 参数进行 PHP 代码评估（本 PoC 中实现），从而导致未认证远程代码执行，这是一个严重系统漏洞。 快速开始 依赖项 Python 3 及 Python 标准库 开源 Git 版本控制系统 其他 Python 包/模块（详见 requirements.tx...

CVE-2026-100644 SiYuan before v3.8.4 SQL Injection via dailyNoteSavePath

SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the dailyNoteSavePath parameter is concatenated into SQL without escaping. Unauthenticated attackers on published sites with auth disabled can inject SQL via UNION SELECT to extract arbitrary database ro...

EUVD-2026-87738

SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the dailyNoteSavePath parameter is concatenated into SQL without escaping. Unauthenticated attackers on published sites with auth disabled can inject SQL via UNION SELECT to extract arbitrary database ro...

CVE-2026-100644 SiYuan before v3.8.4 SQL Injection via dailyNoteSavePath

SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the dailyNoteSavePath parameter is concatenated into SQL without escaping. Unauthenticated attackers on published sites with auth disabled can inject SQL via UNION SELECT to extract arbitrary database ro...

CVE-2026-100644 SiYuan before v3.8.4 SQL Injection via dailyNoteSavePath

SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the dailyNoteSavePath parameter is concatenated into SQL without escaping. Unauthenticated attackers on published sites with auth disabled can inject SQL via UNION SELECT to extract arbitrary database ro...

CVE-2026-100644

Versions of SiYuan prior to v3.8.4 are vulnerable to a SQL injection vulnerability within the graph query endpoint . The root cause is the improper concatenation of the dailyNoteSavePath parameter into SQL queries without sufficient escaping. This flaw allows unauthenticated attackers targeting p...