MSSQL-Analysis-Coerce

MSSQL Analysis Services - Autenticación Forzada Una técnica para obligar a un Windows SQL Server a autenticarse en una máquina arbitraria. Esta prueba de concepto está coescrita por: Podalirius: Worty: Prueba de concepto Para provocar la autenticación como cuenta de máquina local, necesitamos...

SQLRecon

SQLRecon SQLRecon es un conjunto de herramientas para Microsoft SQL Server diseñado para reconocimiento ofensivo y post-explotación. Para obtener información detallada sobre cómo usar cada técnica, consulta la wiki. Puedes descargar una copia de SQLRecon desde la página de releases...

CVE-2026-18782-TREX-MES-Uygulamalarinda-SQL-Zafiyeti

TREX-MES-Uygulamalarında-SQLi-Zafiyeti CVE-2026-18782 Descripción general TREX MES es una plataforma comercial de Sistema de Ejecución de Manufactura MES / Industria 4.0 utilizada para recopilar y gestionar datos desde la planta de producción. La API web de la aplicación ejecuta directamente el...

MultiExploit

Escáner de Vulnerabilidades Multi-Servicio Vulnerabilidades Compatibles y Vectores de Ataque Vulnerabilidades de Microsoft SQL Server CVE-2023-21173 : Ejecución remota de código en SQL Server 2022 Explotación potencial de: Configuraciones de autenticación débiles Principios de servidor mal...

Backup Logs Periodically Is Not Supported for More Than One Database Engine per Job Object (Veeam Agents and Plug-ins)

Challenge When saving Guest Processing settings for a Veeam Agents backup job with periodic transaction log backup enabled for more than one database engine Microsoft SQL Server, Oracle, or PostgreSQL on the same job object, the following error occurs: Concurrent transaction log backup is not...

SUSE CVE-2026-101878

Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the UserReadBySsoUserOrganizationIdExternalId stored procedure as NVARCHAR50 while the column it queries stores NVARCHAR300, silently truncating the SSO login identifier on SQL Server deployments and allowing a user...

CVE-2023-54400

Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary SQL through the Name parameter of the getEmpByname action without any authentication. Attackers can exploit UNION-based SQL injection...

CVE-2023-54400 Fumeng Cloud SQL Injection via AjaxMethod.ashx getEmpByname

Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary SQL through the Name parameter of the getEmpByname action without any authentication. Attackers can exploit UNION-based SQL injection...

EUVD-2023-60696

Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary SQL through the Name parameter of the getEmpByname action without any authentication. Attackers can exploit UNION-based SQL injection...

CVE-2023-54400 Fumeng Cloud SQL Injection via AjaxMethod.ashx getEmpByname

Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary SQL through the Name parameter of the getEmpByname action without any authentication. Attackers can exploit UNION-based SQL injection...

CVE-2023-54400

Fumasoft Fumeng Cloud is vulnerable to a SQL injection flaw in the AjaxMethod.ashx endpoint. Specifically, the getEmpByname action fails to properly sanitize the Name parameter, allowing unauthenticated remote attackers to execute arbitrary SQL commands against the Microsoft SQL Server backend. E...

CVE-2026-101878

Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the UserReadBySsoUserOrganizationIdExternalId stored procedure as NVARCHAR50 while the column it queries stores NVARCHAR300, silently truncating the SSO login identifier on SQL Server deployments and allowing a user...

CVE-2026-101878 Bitwarden Server 2025.6.0 < 2025.6.0 Authentication Bypass via SSO Identifier Truncation

Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the UserReadBySsoUserOrganizationIdExternalId stored procedure as NVARCHAR50 while the column it queries stores NVARCHAR300, silently truncating the SSO login identifier on SQL Server deployments and allowing a user...

CVE-2026-101878 Bitwarden Server 2025.6.0 < 2025.6.0 Authentication Bypass via SSO Identifier Truncation

Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the UserReadBySsoUserOrganizationIdExternalId stored procedure as NVARCHAR50 while the column it queries stores NVARCHAR300, silently truncating the SSO login identifier on SQL Server deployments and allowing a user...

CVE-2026-101878

Bitwarden Server versions 2025.6.0 before 2026.5.0 are vulnerable to an authentication bypass on SQL Server deployments. The root cause is an identifier truncation issue where the @ExternalId parameter of the User_ReadBySsoUserOrganizationIdExternalId stored procedure is declared as NVARCHAR(50),...

EUVD-2026-88605

Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the UserReadBySsoUserOrganizationIdExternalId stored procedure as NVARCHAR50 while the column it queries stores NVARCHAR300, silently truncating the SSO login identifier on SQL Server deployments and allowing a user...

CVE-2026-101878 Bitwarden Server 2025.6.0 < 2025.6.0 Authentication Bypass via SSO Identifier Truncation

Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the UserReadBySsoUserOrganizationIdExternalId stored procedure as NVARCHAR50 while the column it queries stores NVARCHAR300, silently truncating the SSO login identifier on SQL Server deployments and allowing a user...

CVE-2023-54400: Improper Neutralization of Special Elements used in an SQL Command

Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary SQL through the Name parameter of the getEmpByname action without any authentication. Attackers can exploit UNION-based SQL injection...

CVE-2026-101878: Incorrect Implementation of Authentication Algorithm

Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the UserReadBySsoUserOrganizationIdExternalId stored procedure as NVARCHAR50 while the column it queries stores NVARCHAR300, silently truncating the SSO login identifier on SQL Server deployments and allowing a user...

PT-2026-102632

Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary SQL through the Name parameter of the getEmpByname action without any authentication. Attackers can exploit UNION-based SQL injection...