EUVD-2026-97174

A vulnerability was determined in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Impacted is the function PublicController::sendFindPwdMail of the file Admin/Home/Controller/PublicController.class.php of the component Password Recovery Mail Endpoint. This manipulation of the argument...

CVE-2026-26980

CVE-2026-26980 — 👻 Ghost CMS Unauthenticated SQLi via Content API A SQL injection vulnerability existed in Ghost's Content API that allowed unauthenticated attackers to read arbitrary data from the database. | ---|--- CVE| CVE-2026-26980 CVSS| 9.4 Critical Affected| Ghost = 3.24.0, = 6.19.0 Fixed...

CVE-2026-26980-PoC

CVE-2026-26980 — Ghost CMS Content API Blind SQL Injection Affected: Ghost 3.24.0 – 6.19.0 Fixed in: Ghost 6.19.1 Auth required: None — Content API key is public Impact: Unauthenticated read of the entire database credentials, API keys Vulnerability slug-filter-order.js interpolates user-supplied...

CVE-2019-1698

TRAN CONG DANH - SVTT - Mentor: LUU VAN LAN - CVE-2019-1698 - Day Started: 30/07/2024 Check the diff code betwween ver has vuln and ver of code with fix vuln: Code reference 1: https://plugins.trac.wordpress.org/changeset/3040809/notificationx/trunk/includes/Core/Rest/Analytics.php Code reference...

semcms

Introduction to Semcms SEMCMS is a foreign trade website content management system CMS that supports multiple languages. v4.8 Download Link: http://www.sem-cms.com/TradeCmsdown/php/semcmsphp4.8.zip Causes of vulnerabilities: /xcR45qAdmin/SEMCMSMenu.php Line 66 Vulnerability code: query"SELECT FRO...

Royal-Event-Management-System-todate-SQL-Injection-Authenticated

Royal Event Management System - 'todate' SQL Injection Authenticated 1. Description: Royal Event Management System 1.0 allows SQL Injection via parameter 'todate' in /royalevent/btndatesreport.php?= Exploiting this issue could allow an attacker to compromise the application, access or modify data...

CVE-2023-46017-Code-Projects-Blood-Bank-1.0-SQL-Injection-Vulnerability

CVE-2023-46017-Code-Projects-Blood-Bank-1.0-SQL-Injection-Vulnerability Exploit Author: ersinerenler Vendor Homepage https://code-projects.org/blood-bank-in-php-with-source-code Software Link https://download-media.code-projects.org/2020/11/BloodBankInPHPWithSourcecode.zip Overview Code-Projects...

CVE-2025-57819-POC

CVE-2025-57819 — FreePBX SQL Injection → RCE PoC CVE-2025-57819 is a critical SQL injection vulnerability in FreePBX that allows an unauthenticated attacker to achieve remote code execution by chaining a SQL injection with cron job injection. ⚠️ Disclaimer : This repository is for authorized...

CVE-2026-108794

A security vulnerability has been detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this vulnerability is an unknown functionality of the file /base/api/v1.0/systemSettings/dbmigratesetting/ of the component Database Migration Functionality. Such manipulation leads to sql injectio...

sqlmate

sqlmate There are some features that we think SQLMap should have. Like finding admin panel of the target, better hash cracking etc. If you think the same, SQLMate is for you. What it does? Feed it a SQL injection dork via --dork option and it will find vulnerable sites for you. After that, it wil...

API-attack-detection-with-AI

Detection of SQL/XSS Attacks on Web API with Artificial Intelligence / Machine Learning This project aims to detect SQL and XSS injections in API requests/params using machine learning. Project Overview This project aims to detect SQL and XSS injections in API requests and parameters using Machin...

FreePBX-CVE-2025-57819

FreePBX CVE-2025-57819 — Unauthenticated SQLi to Root RCE Severity: Critical Type: Unauthenticated SQL Injection → Remote Code Execution Affected Software: FreePBX endpoint module Tested On: FreePBX on CentOS 7, Apache 2.4, PHP 7.4, MariaDB 5.5 Overview An unauthenticated SQL injection...

CVE-2026-108794 ZKTeco BioTime Database Migration Functionality db_migrate_setting sql injection

A security vulnerability has been detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this vulnerability is an unknown functionality of the file /base/api/v1.0/systemSettings/dbmigratesetting/ of the component Database Migration Functionality. Such manipulation leads to sql injectio...

EUVD-2026-97164

A security vulnerability has been detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this vulnerability is an unknown functionality of the file /base/api/v1.0/systemSettings/dbmigratesetting/ of the component Database Migration Functionality. Such manipulation leads to sql injectio...

CVE-2026-108794

A security vulnerability exists in ZKTeco BioTime 9.5.6 Build 20260130.3206 within the Database Migration Functionality component. An unknown functionality in the file /base/api/v1.0/systemSettings/db_migrate_setting/ is susceptible to SQL injection . This vulnerability can be exploited remotely ...

CVE-2023-42284

Disclaimer For educational purpose only! Details Proof of concept for CVE-2023-42284. Tyk Gateway is vulnerable to SQL injection. Fixed in 5.0.7 version. The URL parameter ‘apiversion’ of the "https:///api/errors/count/...?res=day&p=...&apiversion=&apiid=..."is vulnerable to Blind SQL injection...

unknownpwn.github.io

Tecnovision LED Video Wall Vulnerabilities and Exploits. From SQLi to full root access. Introduction: Tecnovision is a manufacturer of LED Video Walls used in arenas For example, Twickenham Stadium, concert halls, shopping malls, as roadsigns and much much more. DlxSpot Player 4 is the software...

CVE-2026-63039

CVE-2026-63039 — Apache InLong AuditAlertRule ORDER BY SQL injection Runnable proof-of-concept reproducer for the SQL injection in Apache InLong's audit-alert-rule query. The InLong manager mapper AuditAlertRuleEntityMapper.selectByCondition filters with safe MyBatis parameters, but sorts with $...

CVE-2022-41853

Research into CVE-2022-41853: Using static functions to obtian RCE via Java Deserialization & Remote Codebase Attack Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb HyperSQL DataBase to process untrusted input may be vulnerable to a remote code execution attack. By default ...

CVE-2026-108782

A weakness has been identified in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected by this issue is the function CommonServiceImpl.getAutoList of the file src/main/java/org/jeecgframework/core/common/service/impl/CommonServiceImpl.java of the component Autocomplete Handler. Executing a manipulati...