CVE-2026-78804_Dolibarr_authenticated_SQL_injection

Dolibarr — Authenticated SQL Injection PoC SQL injection affecting the product stock management functionality through the seuilstockalerte parameter. Affected Versions Tested and confirmed on: 19.0.4 20.0.4 21.0.4 22.0.5 23.0.3 24.0.0 It was working until the report. Vulnerable Parameter...

CVE-2025-26794-exploit

CVE-2025-26794: Exim ETRN SQL Injection Exploit A proof-of-concept exploit tool for CVE-2025-26794, demonstrating SQL injection vulnerability in Exim 4.98 mail server via the ETRN command when using SQLite DBM storage. ⚠️ Legal Disclaimer FOR AUTHORIZED SECURITY TESTING ONLY This tool is provided...

CVE-2025-9172

Exploit: Time-Based SQL Injection via /vibes/v1/beacon unauthenticated Browser Console PoC async = const url = 'http://localhost/wordpress/index.php?restroute=/vibes/v1/beacon'; async function sendresource const body = type: 'navigation', resource, // injected into SQL unprepared authenticated: 0...

CVE-2024-55099-Online-Nurse-Hiring-System-v1.0-SQL-Injection-Vulnerability-

CVE-2024-55099-Online-Nurse-Hiring-System-v1.0-SQL-Injection-Vulnerability Exploit Author: ugurkarakoc Vendor Homepage https://phpgurukul.com/online-nurse-hiring-system-using-php-and-mysql Software Link https://phpgurukul.com/?sdmprocessdownload=1&downloadid=17826 Overview...

ColorOS-CVE-2025-10184

Information Source Vulnerability Principle & Solution Technical Analysis Vulnerability Details Type: Database injection attack 1=1 AND Impact: Any app can read SMS data. No permissions required, no user interaction, undetectable reading Affected: All SMS messages and verification codes on the...

CVE-2026-24417

CVE-2026-24417: OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Service Overview Field| Details ---|--- CVE ID| CVE-2026-24417 Severity| HIGH Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products devcode-it/openstamanager versions: 2.9.8 CWE...

CVE-2026-30655

CVE-2026-30655 — SQL Injection in esiclivre password reset Summary A SQL injection vulnerability exists in the password reset endpoint of esiclivre. An unauthenticated attacker can inject SQL via the cpfcnpj POST parameter, potentially resulting in unauthorized access to sensitive information...

CVE-2025-11177

Trigger the SQLi with a time-based payload in the public login curl -w '\nTIME:%timetotal\n' -s \ -d 'log=anything%27%3B%20SELECT%20pgsleep5%3B%20--&pwd=irrelevant&wp-submit=Log+In' \ -d 'redirectto=' \ -d 'testcookie=1' \ 'http://target/wp-login.php'...

CVE-2026-25513

CVE-2026-25513: FacturaScripts has SQL Injection in API ORDER BY Clause Overview Field| Details ---|--- CVE ID| CVE-2026-25513 Severity| HIGH Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products facturascripts/facturascripts versions: 2025.81 CWE Classification CWE-20: Improper...

CVE-2026-84209

IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command...

CVE-2026-81932

IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database...

CVE-2026-80381

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute unauthorized SQL statements due to SQL injection...

CVE-2025-71428

Jivejdon through 5.0 contains a sql injection vulnerability in AccountDaoSql.getAccountByNameLike that allows authenticated administrators to inject SQL via the username parameter. Attackers with the Admin role can submit crafted input to /admin/user/userListAction to read database contents,...

CVE-2025-71428 Jivejdon through 5.0 SQL Injection via username in userListAction

Jivejdon through 5.0 contains a sql injection vulnerability in AccountDaoSql.getAccountByNameLike that allows authenticated administrators to inject SQL via the username parameter. Attackers with the Admin role can submit crafted input to /admin/user/userListAction to read database contents,...

CVE-2025-71428

Versions of Jivejdon through 5.0 are vulnerable to a SQL injection flaw in the AccountDaoSql.getAccountByNameLike() method. Authenticated users with the Admin role can exploit this by submitting crafted input to the /admin/user/userListAction endpoint via the username parameter . Successful explo...

CVE-2025-71428 Jivejdon through 5.0 SQL Injection via username in userListAction

Jivejdon through 5.0 contains a sql injection vulnerability in AccountDaoSql.getAccountByNameLike that allows authenticated administrators to inject SQL via the username parameter. Attackers with the Admin role can submit crafted input to /admin/user/userListAction to read database contents,...

CVE-2026-80381 Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute unauthorized SQL statements due to SQL injection...

CVE-2026-80381

IBM Guardium Data Protection versions 12.0, 12.1, and 12.2 are vulnerable to a SQL injection flaw within the Sniffer component . This vulnerability (CWE-89) could allow a remote attacker to execute unauthorized SQL statements . To remediate this, IBM strongly recommends applying the latest Sniffe...

CVE-2026-81932

IBM Guardium Data Protection versions 12.0 , 12.1 , and 12.2 are vulnerable to an SQL injection (CWE-89) within the Sniffer component . A remote unauthenticated attacker could send specially crafted SQL statements to view, add, modify, or delete information in the back-end database. To remediate ...

CVE-2026-84209 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command...