CVE-2026-88756

Pagekit CMS = 1.0.18 allows an unauthenticated attacker to perform SQL injection through the credentials array submitted to the public login endpoint POST /user/authenticate...

CVE-2026-88756

Pagekit CMS = 1.0.18 allows an unauthenticated attacker to perform SQL injection through the credentials array submitted to the public login endpoint POST /user/authenticate...

PT-2026-96301

Name of the Vulnerable Software and Affected Versions Chartbrew versions prior to 5.2.2 Description The runQuery function in server/modules/ai/orchestrator/tools/runQuery.js fails to perform runtime integer validation on the row limit parameter before interpolating it into a SQL LIMIT clause...

CVE-2026-88402

A SQL injection vulnerability exists in the checkSQL function of nocobase v2.1.21 . This flaw allows an attacker to inject crafted SQL statements to access sensitive database information . The vulnerability is rated as CRITICAL with a CVSS 3.1 score of 9.8, indicating a high impact on confidentia...

PT-2026-96305

Name of the Vulnerable Software and Affected Versions Pagekit CMS versions prior to 1.0.19 Description An unauthenticated attacker can perform SQL injection, a technique used to manipulate database queries, by submitting a malicious credentials array to the public login endpoint 'POST...

PT-2026-96288

Name of the Vulnerable Software and Affected Versions nocobase version 2.1.21 Description A SQL injection issue exists in the checkSQL function, which allows attackers to access sensitive database information by injecting crafted SQL statements. SQL injection is a technique where malicious SQL co...

PT-2026-96045

Name of the Vulnerable Software and Affected Versions drogonframework drogon versions prior to 1.9.14 Description A flaw in the ORM component affects the makeCriteria function within the orm lib/src/Criteria.cc library. A remote attacker can perform a SQL injection by manipulating the filter...

PT-2026-96040

Name of the Vulnerable Software and Affected Versions drogonframework drogon versions prior to 1.9.14 Description A remote SQL injection is possible within the ORM Mapper component. The issue resides in the Mapper::orderBy function located in the Mapper.h library, where improper handling of the...

EUVD-2026-84194

A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allows attackers to access sesntive database information via injecting crafted SQL statements...

Linux Distros Unpatched Vulnerability : CVE-2026-54354

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MapServer is a system for developing web-based GIS applications. Prior to 8.6.4, MapServer's PostGIS runtime filter translation in src/mappostgis.cpp and...

MariaDB SQL Injection

The vulnerability of the mysqlrealescapestring function in the MariaDB database management system is related to the lack of protective measures for SQL query structures. Exploiting this vulnerability allows an attacker to execute SQL injections remotely...

cctv

CCTV — HackTheBox ウォークスルー プラットフォーム: HackTheBox | OS: Linux 攻撃チェーン CVE-2024-51482 を悪用した ZoneMinder の SQL インジェクションにより、データベースから bcrypt ハッシュが漏洩する。hashcat でクラックすると SSH アクセスが得られる。ポートフォワーディングで露出した内部の motionEye インスタンスは CVE-2025-60787 に脆弱であり、root シェルを取得できる。 列挙 root@kitploit: nmap -sV -sC 10.129.53.160 -Pn...

Exploit for SQL Injection in Zoneminder

ZoneMinder 1.29/1.30 SQLi to RCE Exploit A ready-to-run Pytho...

Exploit for CVE-2026-88854

CVE-2026-88854 — OrdaSoft Joomla Gallery SQL Injection Python...

CVE-2026-94041

A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Affected by this issue is some unknown functionality of the file admin/addmenu.php. The manipulation of the argument item/price/image/type leads to sql injection. It is...

CVE-2026-94042

A vulnerability was found in AdithyaYelloju Restaurant Management System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This affects the function mysqliquery of the file admin/addtable.php. The manipulation of the argument table/members/price results in sql injection. It is possible to launch th...

CVE-2026-88855

Joomla Extension - OrdaSoft.com - Authenticated, Privileged SQL Injection in OrdaSoft Joomla Gallery extension for Joomla 6.2.7 - The extensions saveGallery passes form data through a hand-rolled parser into Joomla’s Input object, then reads it back with the ARRAY/ STRING filter types, neither of...

CVE-2026-88854

Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla getVar, which is not a real Joomla filter method and falls through to a filter that strips HTML tags but does not touch quotes or SQL syntax. The value is concatenated directly into a...

CVE-2026-88854 Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7

Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla getVar, which is not a real Joomla filter method and falls through to a filter that strips HTML tags but does not touch quotes or SQL syntax. The value is concatenated directly into a...

CVE-2026-88854

CVE-2026-88854 is an unauthenticated SQL injection in the OrdaSoft Joomla Gallery extension (mod_osgallery_search) affecting Joomla getVar()—not a real Joomla filter method—so only HTML tags are stripped while quotes and SQL syntax pass through. The value is concatenated directly into a LIKE clau...