287192 matches found
WebAttackDetector
WebAttackDetector Static machine-learning triage for suspicio...
ProcessMaker SQL Injection Vulnerability
Versions of ProcessMaker prior to 2026.14.3 have a SQL injection vulnerability. This vulnerability stems from the unvalidated orderby parameter in the GET /api/1.0/tasks endpoint. The orderby parameter is bound to user-controlled processrequests column names, which are used in the DB::raw SQL...
Security Bulletin: Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection
Summary Multiple vulnerabilities have been addressed in the Sniffer component as part of IBM Guardium Data Protection Vulnerability Details CVEID:CVE-2026-75875 DESCRIPTION: IBM Guardium Data Protection could allow a remote attacker to execute arbitrary code due to path traversal. CWE:CWE-22:...
CVE-2026-9209
mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the runQueryButton postback and exportSqlQueryServer PageMethod execute caller-supplied SQL against the backing Sybase SQL Anywhere database using DBA/sysadmin...
sxwp2shell
/ / / / / / | |/ / \ / / / / / / / / | / / / / / / / // / / / / / // | //// ///// /////|| sxwp2shell — Pre-auth RCE exploit for WordPress via REST API batch-route confusion CVE-2026-63030 + SQL injection CVE-2026-60137. Affected: WP 6.9.0–6.9.4 / 7.0.0–7.0.1 Install git clone...
CVE-2026-9209 mJobTime 15.7.3.32 Unauthenticated SQL Execution RCE via Login.aspx
mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the runQueryButton postback and exportSqlQueryServer PageMethod execute caller-supplied SQL against the backing Sybase SQL Anywhere database using DBA/sysadmin...
EUVD-2026-95035
mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the runQueryButton postback and exportSqlQueryServer PageMethod execute caller-supplied SQL against the backing Sybase SQL Anywhere database using DBA/sysadmin...
CVE-2026-9209
Versions of mJobTime through build 15.7.3.32 are vulnerable to an unauthenticated SQL execution vulnerability within the Login.aspx admin panel handlers. Specifically, the runQueryButton postback and exportSqlQuery_Server PageMethod fail to enforce server-side authentication, relying instead on a...
CVE-2026-9209 mJobTime 15.7.3.32 Unauthenticated SQL Execution RCE via Login.aspx
mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the runQueryButton postback and exportSqlQueryServer PageMethod execute caller-supplied SQL against the backing Sybase SQL Anywhere database using DBA/sysadmin...
Exploit for Authentication Bypass Using an Alternate Path or Channel in Sangoma Freepbx
freepbx-rce-detector Triage scanner for CVE-2025-57819, t...
CVE-2026-105076
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Appsbd Vitepos vitepos-lite allows Blind SQL Injection.This issue affects Vitepos: from n/a through 3.6.1...
CVE-2026-105076 WordPress Vitepos plugin <= 3.6.1 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Appsbd Vitepos vitepos-lite allows Blind SQL Injection.This issue affects Vitepos: from n/a through 3.6.1...
CVE-2026-105076 WordPress Vitepos plugin <= 3.6.1 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Appsbd Vitepos vitepos-lite allows Blind SQL Injection.This issue affects Vitepos: from n/a through 3.6.1...
CVE-2026-105076
The Appsbd Vitepos vitepos-lite WordPress plugin is vulnerable to Blind SQL Injection in versions up to and including 3.6.1 . The root cause is the Improper Neutralization of Special Elements used in an SQL Command (CWE-89). This flaw allows an attacker to perform unauthorized database queries. N...
EUVD-2026-94942
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Appsbd Vitepos vitepos-lite allows Blind SQL Injection.This issue affects Vitepos: from n/a through 3.6.1...
WordPress Vitepos plugin <= 3.6.1 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Peter Tang in WordPress Plugin Vitepos versions = 3.6.1...
SQL-Injection-Cheat-Sheet
SQL-Inje...
Vulnerabilities in Kiteworks
Kiteworks has identified several vulnerabilities in its Kiteworks product line. These vulnerabilities concern various components and functions within the products. - Authorized administrators may exploit insufficient validation in import and export functions, resulting in the writing of files at...
CVE-2026-12260
SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable to blind attacks based on Boolean, error, time-based and UNION techniques. Exploitation allows attacke...