cve-2026-6379

CVE-2026-6379 — WP Photo Album Plus :8080/?pageid=" --mode probe python3 ../pocs/exploit.py "http://:8080/?pageid=" --mode probe-calendar python3 ../pocs/exploit.py "http://:8080/?pageid=" --mode version python3 ../pocs/exploit.py "http://:8080/?pageid=" --mode hash Un target vulnerabile risponde...

CVE-2026-10110-SQLi

Student Details Management System 1.0 - SQL Injection Non autenticata Informazioni sulla vulnerabilità Campo| Dettagli ---|--- Prodotto| Student Details Management System Vendor| code-projects.org Versione| 1.0 Tipo di vulnerabilità| SQL Injection CWE-89 ID CVE| In sospeso Punteggio CVSS| 9.8...

CVE-2026-10170-RCE

Visitor Management System 1.0 - SQLi a Esecuzione di Codice Remoto Catena di Attacco Informazioni sulla Vulnerabilità Campo| Dettagli ---|--- Prodotto| Visitor Management System Venditore| code-projects.org Versione| 1.0 Classi di Vulnerabilità| SQL Injection CWE-89 + Upload di File Senza...

CVE-2026-42167-PoC

CVE-2026-42167 POC Esecuzione di codice remoto pre-autenticazione in ProFTPD tramite SQL injection in modsql Autore: Van Glenndon Enad Scoperta originale: ZeroPath Pubblicato: 1 maggio 2026 Gravità: Critica Punteggio CVSS v3.1: 8.1 Vettore CVSS v3.1: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H...

CVE-2021-32099

poc : http://127.0.0.1:8888/pandoraconsole/include/chartgenerator.php?sessionid=%27%20union%20SELECT%201,2,%27idusuario|s:5:%22admin%22;%27%20as%20data%20--%20SgGO https://blog.sonarsource.com/pandora-fms-742-critical-code-vulnerabilities-explained...

CVE-2021-35042

CVE-2021-35042: Vulnerabilità di SQL injection in Django I. Panoramica Django è un framework per applicazioni web open source, scritto in Python e costruito secondo il modello MVC Model - View - Controller. Inizialmente è stato creato per gestire i siti web di contenuti di notizie di proprietà de...

CVE-2026-7394-SQLI

SQL Injection nel sistema e-commerce Pizzafy — admin/vieworder.php Dettagli Campo| Valore ---|--- Fornitore| SourceCodester Prodotto| Sistema e-commerce Pizzafy basato su PHP e MySQL Versione| 1.0 Vulnerabilità| SQL Injection CWE| CWE-89 Punteggio CVSSv3| 7.2 Alto Vettore di attacco| Rete...

CVE-2026-107385

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, text-protocol escaping always prefixes quotes with a backslash and does not honor the session's NOBACKSLASHESCAPES mode, including in...

CVE-2026-107384

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.0 until 3.2.5, 3.3.4, 3.4.7, and 3.5.4, applications that enable permitSetMultiParamEntries can pass objects whose keys are expanded into a SQL SET clause without being processe...

CVE-2025-26794-Exim-Mail-SQLi

Questo repository non contiene un README...

CVE-2026-107385 MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, text-protocol escaping always prefixes quotes with a backslash and does not honor the session's NOBACKSLASHESCAPES mode, including in...

CVE-2026-107385

The MariaDB Connector/Node.js library is vulnerable to SQL injection in its text protocol when the session uses the NO_BACKSLASH_ESCAPES mode. Specifically, the connector fails to honor this mode in Connection.escape(), always prefixing quotes with a backslash. Because the backslash is treated as...

CVE-2026-107385

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, text-protocol escaping always prefixes quotes with a backslash and does not honor the session's NOBACKSLASHESCAPES mode, including in...

CVE-2026-107385 MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, text-protocol escaping always prefixes quotes with a backslash and does not honor the session's NOBACKSLASHESCAPES mode, including in...

EUVD-2026-95150

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, text-protocol escaping always prefixes quotes with a backslash and does not honor the session's NOBACKSLASHESCAPES mode, including in...

CVE-2026-107385 MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, text-protocol escaping always prefixes quotes with a backslash and does not honor the session's NOBACKSLASHESCAPES mode, including in...

CVE-2025-61455

🛡️ CVE-Offenlegung: CVE-2025-61455 — SQL-Injection im E-Commerce-Projekt Offenlegungsdatum: 14. Oktober 2025 CVE-ID: CVE-2025-61455 Schweregrad: KRITISCH CVSS 9.8 🧩 Zusammenfassung Eine kritische SQL-Injection-Schwachstelle besteht im E-commerce Project v1.0, insbesondere im Endpunkt...

CVE-2026-1312

CVE-2026-1312 ist eine kritische Django-SQL-Injection-Schwachstelle: Wenn in QuerySet.orderby Spaltenaliase mit Punkten verwendet werden und in Kombination mit FilteredRelation über Dictionary-Expansion dynamisch Abfragen konstruiert werden, kann ein Angreifer bösartiges SQL injizieren Betroffene...

CVE-2026-1207

CVE-2026-1207 Django GIS RasterField SQL-Injection-Reproduktion Schwachstellenübersicht Schwachstellentyp : SQL-Injection Betroffene Komponente : django.contrib.gis RasterField Bei der Verwendung von Django GIS RasterField für Abfragen wird der Parameter band direkt in die SQL-Anweisung eingefügt...

CVE-2024-36840-Exploit

CVE-2024-36840: Vulnerabilità di SQL Injection in Boelter Blue System Management Versione 1.3 Dettagli dell'Exploit Titolo dell'Exploit : Vulnerabilità di SQL Injection in Boelter Blue System Management versione 1.3 Google Dork Originale : inurl:"Powered by Boelter Blue" non ha funzionato zero ur...