Stash < 0.26.0 - SQL Injection

Stash up to v0.25.1 was discovered to contain a SQL injection vulnerability via the sort parameter. id: CVE-2024-32231 info: name: Stash Stash" tags: cve,cve2024,stash,sqli,vuln http: - raw: - | POST /graphql HTTP/1.1 Host: Hostname Content-type: application/json...

CVE-2021-43609-POC

Spiceworks Sort SQLi Spiceworks 的 sort 参数中存在一处 SQLi。完整利用链为 SQLi - 文件读取 - RCE。 演示 先决条件 root@kitploit: apt update && apt install -y ruby-dev nodejs python3 python3-pip libsqlite3-dev pip3 install requests gem install bundler && cd rce && bundle install 阶段 1 使用 poc.py 利用 SQLi - 文件读取并提取 secretkeybase...

CVE-2021-36396-Moodle-Time-Based-SQLi-Exploit

CVE-2021-36396 漏洞利用 描述 此仓库包含一个基于Python的漏洞利用脚本，针对CVE-2021-36393，这是Moodle最近课程功能中发现的一个严重漏洞。该缺陷存在于'sort'参数中，导致SQL注入攻击，可能未经授权访问数据库。CVSS评分为9.8，利用此漏洞需要最低权限（如学生角色），并严重危害数据的机密性和完整性。 受影响的版本： 3.11, 3.10 至 3.10.4, 3.9 至 3.9.7 以及更早的不受支持的版本 安装 要使用此漏洞利用工具，你需要在系统上安装Python。克隆此仓库并安装所需依赖： root@kitploit: git clone...

AOSP-DownloadProviderDbDumperSQLiLimit

AOSP-DownloadProviderDbDumperSQLiLimit 利用Android下载提供程序排序参数中SQL注入的PoC CVE-2019-2196 安全公告 Android AOSP 下载提供程序查询排序参数中的SQL注入 CVE-2019-2196 演示...

CVE-2008-4687-exploit

CVE-2008-4687-exploit 针对CVE-2008-4687的快速且粗糙的python漏洞利用程序。 NIST描述： Mantis 1.1.4之前版本中的manageprojpage.php允许远程认证用户通过包含PHP序列的sort参数执行任意代码，这些PHP序列由core/utilityapi.php中的multisort函数内的createfunction处理。...

CVE-2025-32429

CVE-2025-32429 XWiki SQL注入概念验证 作者： Byte Reaper Telegram： @ByteReaper0 CVE： CVE‑2025‑32429 漏洞： XWiki LiveData REST API中的盲SQL注入 受影响文件： getdeleteddocuments.vm sort参数 描述： XWiki平台LiveData REST端点在使用getdeleteddocuments.vm的sort参数时存在盲SQL注入漏洞。攻击者可注入任意SQL片段，利用基于时间的负载（SLEEP）或联合查询来枚举数据库内容。...

CVE-2026-25746_SqlInjectionVulnerabilityOpenEMR7.0.4

CVE-2026-25746 - OpenEMR 弱点 CWE-89 未正确中和用于 SQL 命令的特殊元素（'SQL 注入'） 产品使用来自上游组件的受外部影响的输入来构建 SQL 命令的全部或部分内容，但未中和或错误地中和了在发送至下游组件时可能修改预期 SQL 命令的特殊元素。如果没有充分删除或引用用户可控输入中的 SQL 语法，生成的 SQL 查询可能会导致这些输入被解释为 SQL 而非普通用户数据。了解更多信息请访问 MITRE。 摘要 OpenEMR 8.0.0 在处方（prescription）功能中存在 SQL...

CVE-2026-4060-PoC

CVE-2026-4060 — Geo Mashup ≤ 1.13.18 未认证SQL注入PoC -blue 未认证 攻击者可以通过Geo Mashup render-map 端点的 sort 参数向 ORDER BY 子句注入任意SQL，实现基于时间的盲注，提取敏感数据库信息。 目录 漏洞概述 测试环境 如何运行 测试结果 修复建议 检测方法 时间线 参考资料 漏洞概述 技术细节 render-map 端点接收的 sort 参数未经任何净化直接传入 $wpdb-getresults 调用： root@kitploit: // render-map.php 简化 $sort =...

CVE-2026-79569

MovieRecommend v1.0.0 was discovered to contain a SQL injection vulnerability in the sort parameter at /loadingmore. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...

CVE-2026-79569

MovieRecommend v1.0.0 was discovered to contain a SQL injection vulnerability in the sort parameter at /loadingmore. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...

EUVD-2026-72959

MovieRecommend v1.0.0 was discovered to contain a SQL injection vulnerability in the sort parameter at /loadingmore. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...

CVE-2026-79569

Movie_Recommend v1.0.0 is affected by a SQL injection vulnerability in the sort parameter at the /loadingmore endpoint. An unauthenticated, remote attacker can send a crafted SQL statement through this parameter to access sensitive database information. The CVSS 3.1 base score is 9.8 (Critical) ,...

CVE-2026-82538

ILIAS before versions 9.22, 10.10, and 11.3 contains a SQL injection vulnerability in the repository trash table where the table navigation sort field from HTTP requests is passed directly into the ORDER BY clause of a SQL query without validation against declared sortable columns. Authenticated...

CVE-2026-82538

ILIAS before versions 9.22, 10.10, and 11.3 is affected by a SQL injection in the repository trash table . The sort field from HTTP requests is passed directly into the ORDER BY clause without validation against declared sortable columns. Authenticated users with write permission on any container...

CVE-2026-82538 ILIAS Arbitrary SQL Injection via Repository Trash Table Sort Parameter

ILIAS before versions 9.22, 10.10, and 11.3 contains a SQL injection vulnerability in the repository trash table where the table navigation sort field from HTTP requests is passed directly into the ORDER BY clause of a SQL query without validation against declared sortable columns. Authenticated...

PT-2026-86205

CVE-2026-82538 SQLi in ILIAS 9.22, 10.10, 11.3 lets authenticated users with container write access inject arbitrary SQL via sort param. CVSS 8.8. Unpatched—act now. Details: https://t.co/Emh3Jd8yiK ILIAS valtersit CVE CVEAlert infosec SysAdmin cybersecurity Linux devsecops devops developer...

EUVD-2026-70390

WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php endpoint with APIName=channels that allows unauthenticated attackers to order results by arbitrary database columns including users.password and users.recoverPass. Attackers can exploit this orderi...

EUVD-2026-66676

Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources. Spring Data JPA 4.1.0 Spring Data JPA 4.0.0 - 4.0.6 Spring Data JPA 3.5.0 - 3.5.13 Spring Data JPA 3.0.0 - 3.4.15...

CVE-2020-15876

An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via a SQL injection in the sort parameter in the /ajaxtable.php API endpoint. This affects address-search.inc.php, alertlog.inc.php,...

CVE-2020-15876

An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via a SQL injection in the sort parameter in the /ajaxtable.php API endpoint. This affects address-search.inc.php, alertlog.inc.php,...