282213 matches found
WordPresShell
WordPresShell PoC de RCE pre-autenticación para CVE-2026-63030 + CVE-2026-60137 núcleo de WordPress. Confusión de ruta REST /batch/v1 → SQLi WPQuery authornotin → creación de administrador no autenticado → webshell. Archivo único, solo stdlib de Python. Vulnerabilidad: Adam Kues Searchlight Cyber...
CVE-2016-2386
CVE-2016-2386 SAP NetWeaver AS JAVA - Inyección SQL en el componente UDDI POST /UDDISecurityService/UDDISecurityImplBean HTTP/1.1 Host: host Connection: close Accept-Encoding: gzip, deflate Accept: / User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.15; rv:78.0 Gecko/20100101 Firefox/78.0...
CVE-2026-63030
CVE-2026-63030 WordPress REST API batch 路由混淆 + SQL 注入 导致 未授权创建管理员 → 远程代码执行 的完整利用链 PoC。 仅供授权安全测试、漏洞复现与研究使用。禁止用于未授权目标。 漏洞概述 项目| 说明 ---|--- CVE| CVE-2026-63030 组件| WordPress Core REST API /batch/v1 影响版本| WordPress 6.9.0 – 6.9.4 、7.0.0 – 7.0.1 （以官方公告为准） 攻击前提| 目标开启 REST API batch；站点至少有一篇已发布的文章或页面 权限要求...
wp2shell-rce
WP2Shell RCE Una utilidad de evaluación y escaneo diseñada para detectar la exposición a la cadena de explotación WP2Shell en instalaciones de WordPress Core en endpoints individuales o grandes listas de objetivos. ⚠️ Aviso legal Solo escanea sistemas que te pertenezcan o para los que estés...
EUVD-2026-92531
A vulnerability was determined in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Affected by this vulnerability is an unknown functionality of the file transactiondetails.php. Executing a manipulation of the argument transactionid can lead to sql injectio...
CVE-2026-105385 onetwothreeneth HospitalManagementSystem transaction_details.php sql injection
A vulnerability was determined in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Affected by this vulnerability is an unknown functionality of the file transactiondetails.php. Executing a manipulation of the argument transactionid can lead to sql injectio...
CVE-2026-105385 onetwothreeneth HospitalManagementSystem transaction_details.php sql injection
A vulnerability was determined in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Affected by this vulnerability is an unknown functionality of the file transactiondetails.php. Executing a manipulation of the argument transactionid can lead to sql injectio...
CVE-2026-105385
A SQL injection vulnerability exists in the onetwothreeneth HospitalManagementSystem (up to commit 9ef91ed6007314b6473110ed699dff76d158f61d). The flaw is located within an unknown functionality of the transaction_details.php file, where a remote attacker can manipulate the transaction_id argument...
CVE-2026-105385 onetwothreeneth HospitalManagementSystem transaction_details.php sql injection
A vulnerability was determined in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Affected by this vulnerability is an unknown functionality of the file transactiondetails.php. Executing a manipulation of the argument transactionid can lead to sql injectio...
CVE-2024-42327_Zabbix_SQLI
CVE-2024-42327 - Zabbix SQL注入漏洞 SQLI 非盲注且非时间型 针对CVE-2024-42327的POC，该漏洞为Zabbix中通过user.get API方法的认证后SQL注入。 此POC并非像我在其他地方看到的某些POC那样基于时间。 CVE描述 该漏洞存在于user.get API端点，可由具有API访问权限的非管理员用户利用，包括具有默认用户角色的帐户。 SQL注入缺陷存在于CUser类的addRelatedObjects函数中。该函数由CUser.get函数调用，而后者可供具有API访问权限的用户使用。 攻击者可通过操纵API调用来注入SQL命令。...
Deep-Reaver
Deep Reaver Deep Reaver 是一款基于 Python 构建的强大、AI 增强的漏洞评估与利用工具包。受 Nmap 和 Nessus 等工具启发，Deep Reaver 专为 Web 应用及服务进行深度、模块化扫描而设计。 功能特性 通过 aiassistant.py 实现 AI 辅助分析 模块化漏洞扫描： SQL 注入（SQLi） 跨站脚本（XSS） 远程代码执行（RCE） 跨站请求伪造（CSRF） 文件上传测试 暴力破解登录检测 身份验证绕过与主机头注入 CMS 检测及 CVE 检查 LFI/RFI、XXE、CORS、JSONP、点击劫持、SSRF 等...
wp2shell
wp2shell Ejecución remota de código pre-autenticación contra el núcleo de WordPress. Encadena CVE-2026-60137 SQLi en el parámetro authornotin / authorexclude de WPQuery con CVE-2026-63030 confusión de rutas batch en la API REST para RCE no autenticado. Versiones afectadas Rango| Estado ---|--- =...
CVE-2026-76904
GeoServer: Inyección SQL a RCE Zero-Day CVE: CVE-2026-76904 | CVSS: 9.8 Crítico CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Esta vulnerabilidad ha sido asignada GHSA-mqjf-5f49-2fjh por el equipo de GeoServer/GeoTools y está siendo explotada activamente en la naturaleza desde agosto de 2026. La...
CVE-2026-105383
A vulnerability has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This impacts an unknown function of the file php/controller.php. Such manipulation of the argument transactionidS leads to sql injection. The attack can be executed remotely...
CVE-2026-105384 UNION HospitalManagementSystem patient_info.php sql injection
A vulnerability was found in UNION HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Affected is an unknown function of the file patientinfo.php. Performing a manipulation of the argument patientid results in sql injection. The attack is possible to be carried out remotely...
CVE-2026-105384
The UNION HospitalManagementSystem is vulnerable to a remote SQL injection vulnerability in an unknown function within the patient_info.php file. The flaw is triggered by manipulating the patient_id argument. While the exploit has been made public and is usable, the project follows a rolling rele...
CVE-2026-105384 UNION HospitalManagementSystem patient_info.php sql injection
A vulnerability was found in UNION HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Affected is an unknown function of the file patientinfo.php. Performing a manipulation of the argument patientid results in sql injection. The attack is possible to be carried out remotely...
EUVD-2026-92522
A vulnerability was found in UNION HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Affected is an unknown function of the file patientinfo.php. Performing a manipulation of the argument patientid results in sql injection. The attack is possible to be carried out remotely...
CVE-2026-105384 UNION HospitalManagementSystem patient_info.php sql injection
A vulnerability was found in UNION HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Affected is an unknown function of the file patientinfo.php. Performing a manipulation of the argument patientid results in sql injection. The attack is possible to be carried out remotely...
CVE-2026-105383 onetwothreeneth HospitalManagementSystem controller.php sql injection
A vulnerability has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This impacts an unknown function of the file php/controller.php. Such manipulation of the argument transactionidS leads to sql injection. The attack can be executed remotely...