CVE-2026-42167

CVE-2026-42167: SQL Injection in ProFTPD modsql 📋 Executive Summary CVE-2026-42167 is a critical SQL injection vulnerability in ProFTPD's modsql module that allows authentication bypass , backdoor user injection , and remote code execution RCE. Attribute| Value ---|--- Type| SQL Injection CWE-89...

CVE-2026-42167-Exploit

CVE-2026-42167 Master Exploit Tool A professional security research tool for exploiting the CVE-2026-42167 vulnerability in ProFTPD's modsql module. This tool performs unauthenticated SQL injection to exfiltrate sensitive files from the server via time-based side-channel attacks. "Note: The...

cve-2026-6379

CVE-2026-6379 — WP Photo Album Plus :8080/?pageid=" --mode probe python3 ../pocs/exploit.py "http://:8080/?pageid=" --mode probe-calendar python3 ../pocs/exploit.py "http://:8080/?pageid=" --mode version python3 ../pocs/exploit.py "http://:8080/?pageid=" --mode hash A vulnerable target replies in...

CVE-2026-10110-SQLi

Student Details Management System 1.0 - SQL Injection Unauthenticated Vulnerability Information Field| Details ---|--- Product| Student Details Management System Vendor| code-projects.org Version| 1.0 Vulnerability Type| SQL Injection CWE-89 CVE ID| Pending CVSS Score| 9.8 Critical...

CVE-2026-10170-RCE

Visitor Management System 1.0 - SQLi to Remote Code Execution Attack Chain Vulnerability Information Field| Details ---|--- Product| Visitor Management System Vendor| code-projects.org Version| 1.0 Vulnerability Classes| SQL Injection CWE-89 + Unrestricted File Upload CWE-434 CVE ID| Pending CVSS...

CVE-2026-42167-PoC

CVE-2026-42167 POC Pre-Authentication Remote Code Execution in ProFTPD via modsql SQL Injection Author: Van Glenndon Enad Original Discovery: ZeroPath Published: May 1, 2026 Severity: Critical CVSS v3.1 Score: 8.1 CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS v2 Score: 7.6...

CVE-2021-32099

poc : http://127.0.0.1:8888/pandoraconsole/include/chartgenerator.php?sessionid=%27%20union%20SELECT%201,2,%27idusuario|s:5:%22admin%22;%27%20as%20data%20--%20SgGO https://blog.sonarsource.com/pandora-fms-742-critical-code-vulnerabilities-explained...

CVE-2021-35042

CVE-2021-35042: Django SQL injection vulnerability I. Overview Django is an open-source Web Application Framework written in Python, built on the MVC Model - View - Controller model. It was originally built to manage news content websites owned by the Lawrence publishing corporation, as a CMS...

CVE-2026-7394-SQLI

SQL Injection in Pizzafy Ecommerce System — admin/vieworder.php Details Field| Value ---|--- Vendor| SourceCodester Product| Pizzafy Ecommerce System using PHP and MySQL Version| 1.0 Vulnerability| SQL Injection CWE| CWE-89 CVSSv3 Score| 7.2 High Attack Vector| Network Auth Required| Yes...

CVE-2026-107385

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, text-protocol escaping always prefixes quotes with a backslash and does not honor the session's NOBACKSLASHESCAPES mode, including in...

CVE-2026-107384

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.0 until 3.2.5, 3.3.4, 3.4.7, and 3.5.4, applications that enable permitSetMultiParamEntries can pass objects whose keys are expanded into a SQL SET clause without being processe...

CVE-2025-26794-Exim-Mail-SQLi

This repository does not have a README...

CVE-2026-107385

The MariaDB Connector/Node.js library is vulnerable to SQL injection in its text protocol when the session uses the NO_BACKSLASH_ESCAPES mode. Specifically, the connector fails to honor this mode in Connection.escape(), always prefixing quotes with a backslash. Because the backslash is treated as...

CVE-2026-107385 MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, text-protocol escaping always prefixes quotes with a backslash and does not honor the session's NOBACKSLASHESCAPES mode, including in...

CVE-2026-107385 MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, text-protocol escaping always prefixes quotes with a backslash and does not honor the session's NOBACKSLASHESCAPES mode, including in...

EUVD-2026-95150

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, text-protocol escaping always prefixes quotes with a backslash and does not honor the session's NOBACKSLASHESCAPES mode, including in...

CVE-2026-107385 MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, text-protocol escaping always prefixes quotes with a backslash and does not honor the session's NOBACKSLASHESCAPES mode, including in...

CVE-2026-107385

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, text-protocol escaping always prefixes quotes with a backslash and does not honor the session's NOBACKSLASHESCAPES mode, including in...

CVE-2025-61455

🛡️ CVE Disclosure: CVE-2025-61455 — SQL Injection in E-commerce Project Disclosure Date: 14 October 2025 CVE ID: CVE-2025-61455 Severity: CRITICAL CVSS 9.8 🧩 Summary A critical SQL Injection vulnerability exists in E-commerce Project v1.0, specifically within the signup.inc.php endpoint. The...

CVE-2026-1312

CVE-2026-1312 is a high-severity Django SQL injection vulnerability: when a column alias containing a dot is used in QuerySet.orderby, combined with FilteredRelation dynamically constructing queries via dictionary expansion, an attacker may be able to inject malicious SQL Affected versions:...