EUVD-2026-95281

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to modify data and cause a denial of service due to an SQL injection vulnerability...

CVE-2026-16830 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to modify data and cause a denial of service due to an SQL injection vulnerability...

CVE-2026-16830

An SQL injection vulnerability (CWE-89 ) exists in IBM Security Verify Access (versions 10.0 through 10.0.9.2) and IBM Verify Identity Access (versions 11.0 through 11.0.3). A remote authenticated attacker could exploit this flaw to modify data and trigger a denial of service . To remediate, IBM ...

CVE-2023-25157-and-CVE-2023-25158

GeoServer & GeoTools SQL Injection CVE-2023-25157 & CVE-2023-25158 This repository contains a detailed description and replication steps of the SQL Injection vulnerabilities found in the GeoServer platform and GeoTools Library. The vulnerability has been assigned the identifier CVE-2023-25157 for...

CVE-2026-2413

CVE-2026-2413 Ally – Web Accessibility & Usability = 4.0.3 - Unauthenticated SQL Injection via URL Path Description The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to SQL Injection via the URL path in all versions up to, and including, 4.0.3. This is due to insufficien...

CVE-2026-78070

SQL Injection via ORDER BY Shortcode in plgcontentdpcalendar DPCalendar Free ≤ 10.11.2 — Author-level User Extracts Full Database via Time-Based Blind Injection SUMMARY The plgcontentdpcalendar content plugin parses events order="..."/events shortcodes embedded in Joomla article bodies. The order...

HBSQLI

HBSQLI: Probador Automatizado para Inyección SQL Ciega Basada en Cabeceras HBSQLI es una herramienta automatizada de línea de comandos para realizar ataques de inyección SQL ciega basada en cabeceras en aplicaciones web. Automatiza el proceso de detección de vulnerabilidades de inyección SQL cieg...

CVE-2026-24419

CVE-2026-24419: OpenSTAManager has a SQL Injection in the Prima Nota module Overview Field| Details ---|--- CVE ID| CVE-2026-24419 Severity| HIGH Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products devcode-it/openstamanager versions: = 2.9.8 CWE Classification CWE-89: Improper...

CVE-2026-33910_SqlInjectionVulnerabilityOpenEMR8.0.0.2

CVE-2026-33910 - Vulnerabilidad de Inyección SQL en OpenEMR Debilidad CWE-89 Neutralización Inadecuada de Elementos Especiales utilizados en un Comando SQL 'Inyección SQL' El producto construye total o parcialmente un comando SQL utilizando entrada influenciada externamente de un componente...

sqli-hunter-CVE-2024-51482-PoC

sqli-hunter-CVE-2024-51482-PoC Scripts en Python para la explotación de CVE-2024-51482 SQLi en ZoneMinder — HTB CCTV sqli-hunter — CVE-2024-51482 Descripción Este script automatiza la extracción de bases de datos, tablas, columnas y credenciales aprovechando CVE-2024-51482, una vulnerabilidad de...

pyt

.. image:: https://travis-ci.org/python-security/pyt.svg?branch=master :target: https://travis-ci.org/python-security/pyt .. image:: https://readthedocs.org/projects/pyt/badge/?version=latest :target: http://pyt.readthedocs.io/en/latest/?badge=latest .. image::...

CVE-2025-10351-POC

CVE-2025-10351 POC - SQL Injection Exploit 💉 POC for CVE-2025-10351: An unauthenticated SQL Injection vulnerability that affects a specific endpoint in Melis Platform Framework. 🔗 References 📄 CVE-2025-10351 on MITRE 📄 Melis Platform Warning on INCIBE Spanish National Cybersecurity Institute 🚀...

Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities.

Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-82896 DESCRIPTION: IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to traverse directories on the system due to a path traversal vulnerability...

Pybelt

NOTA: Este proyecto ya no se actualiza, este será el último push a este proyecto. Si deseas más información, no dudes en enviarme un mensaje en Twitter: @staysalty Pybelt Pybelt es un cinturón de herramientas de hacker de código abierto completo con: Un escáner de puertos Escáner de inyección SQL...

isr-sqlget

-- ISR - Infobyte Security Research -- | ISR-sqlget | www.infobytesec.com | ..:: DESCRIPTION ISR-sqlget: It's a blind SQL injection tool developed in Perl. It lets you get databases schemas and tables rows. Using a single GET/POST you can access quietly the database structure and using a single...

NPM: MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES

NPM: MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NOBACKSLASHESCAPES vulnerability discovered by ? in WordPress Npm mariadb versions 3.2.5...

MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES

Description When escaping string and binary parameters for the text protocol, the connector always escaped the quote character with a backslash, without ever consulting the session's NOBACKSLASHESCAPES SQL mode. The server status flag was declared STATUSNOBACKSLASHESCAPES but never read. Under a...

NPM: MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)

NPM: MariaDB Connector/Node.js: SQL injection through object keys in SET expansion permitSetMultiParamEntries vulnerability discovered by ? in WordPress Npm mariadb versions = 3.2.0, 3.2.5...

MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)

Description With the non-default permitSetMultiParamEntries option enabled, an object passed as a query parameter is expanded into a SET clause, each key becoming a column name. The three code paths implementing that expansion built the backtick-quoted identifier by hand and wrote the key out...

CVE-2026-60137-and-CVE-2026-63030

wp2shell Lab — CVE-2026-60137 & CVE-2026-63030 WordPress Core Pre-Auth RCE lab — khai thác thật, RCE server. WARNING: Lab chạy WordPress VULNERABLE. Không expose ra internet. Cấu trúc . ├── docker-compose.yml Lab: WordPress 6.9.4 + MariaDB 11 + phpMyAdmin ├── exploit/ PoC exploit clone từ GitHub ...