CVE-2024-50491

CVE-2024-50491 RSVP ME = 1.9.9 - ثغرة حقن SQL غير مصادق عليها الوصف البرنامج الإضافي RSVP ME لووردبريس عرضة لحقن SQL في الإصدارات حتى 1.9.9 وذلك بسبب عدم كفاية الهروب في المعامل المقدم من المستخدم وعدم كفاية التحضير في استعلام SQL الموجود. وهذا يسمح للمهاجمين غير المصادقين بإلحاق استعلامات SQL...

SimpleCTF-THM-Walkthrough

SimpleCTF-THM-Relatory Premier CTF terminé avec succès ! Ce dépôt documente ma procédure pas à pas du Simple CTF de TryHackMe. Il couvre la reconnaissance réseau Nmap, l'exploitation web CVE-2019-9053 et le craquage d'identifiants. En tant que développeur, ce fut intéressant de passer d'une...

DEBIAN-CVE-2026-63268

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name a folder of local text files as a database, so opening a document could read a local text file into the sheet. In fixed versions only the csv, html and xml...

CVE-2026-6433

CVE-2026-6433 — إثبات المفهوم FlipperCode — Custom CSS, JS & PHP · حقن SQL غير مصادق → RCE عبر eval المتأثر: FlipperCode Custom CSS, JS & PHP ≤ 2.0.7 · سطح إضافة ووردبريس عبر admin-ajax.php في لمحة العنصر| التفاصيل ---|--- المتجه| SQLi غير مصادق عبر إجراءات AJAX للإضافة التأثير| تنفيذ كود عن بعد...

CVE-2024-9264

CVE-2024-9264 Grafana Injection SQL DuckDB après authentification RCE, Lecture de fichiers Preuve de concept PoC Cette PoC démontre l'exploitation de CVE-2024-9264 en utilisant un utilisateur authentifié pour exécuter une requête SQL DuckDB et lire un fichier arbitraire sur le système de fichiers...

TraditionalJay

TraditionalJay متجر تقليدي / كلاسيكي قابل للاختراق عمدًا لورش العمل الأمنية — يعمل على جهاز افتراضي VM EC2، Azure VM، أو GCP Compute Engine، وليس حاويات. القصة الرئيسية: اختراق حاسم للجهاز الافتراضي — حقن SQL ← Log4Shell CVE-2021-44228 ← شل عكسية إلى C2 خارجي. !CAUTION لا تنشر إلى حسابات الإنتاج...

BIT-MOODLE-2026-102578 Moodle: sql injection in question bank web service

A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL Structured Query Language injection vulnerability. This issue could allow an attacker to view, alter, or delete...

Astra Linux – Vulnerability in PostgresSQL 11

When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries during the initial establishment of a connection, despite the use of SSL certificate verification and encryption...

CVE-2025-57833

CVE-2025-57833: ثغرة حقن SQL في Django يُوضّح هذا المستودع ويشرح CVE-2025-57833، وهي ثغرة حقن SQL خطيرة في ORM الخاص بـ Django تُؤثر على الإصدارات 4.2 قبل 4.2.24، و5.1 قبل 5.1.12، و5.2 قبل 5.2.6. 🚨 نظرة عامة على الثغرة نقاط CVSS : 9.8 حرجة التأثير : حقن SQL يؤدي إلى تنفيذ تعليمات برمجية عن بُعد R...

EUVD-2026-92421

URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not cover every place a document can supply a URL...

CVE-2026-63270 Environment/ini-file leaks

URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not cover every place a document can supply a URL...

CVE-2026-63268

LibreOffice Calc is vulnerable to a Local File Inclusion (LFI) flaw when linking cell ranges to external data sources. An attacker can exploit the sql provider and sdbc:flat:file:// database href by naming a folder of local text files as a database. This allows a user to read local text files int...

CVE-2026-63268 LFI via calcext:data-mappings, sql provider and sdbc:flat:file:// db href

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name a folder of local text files as a database, so opening a document could read a local text file into the sheet. In fixed versions only the csv, html and xml...

EUVD-2026-92419

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name a folder of local text files as a database, so opening a document could read a local text file into the sheet. In fixed versions only the csv, html and xml...

CVE-2026-63268

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name a folder of local text files as a database, so opening a document could read a local text file into the sheet. In fixed versions only the csv, html and xml...

CVE-2026-63268 LFI via calcext:data-mappings, sql provider and sdbc:flat:file:// db href

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name a folder of local text files as a database, so opening a document could read a local text file into the sheet. In fixed versions only the csv, html and xml...

CVE-2026-63266

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. Through such a link a document could open an embedded Firebird database that wrote a file to any location the user could write to. In fixed versions an embedded Firebird database can open or...

CVE-2026-63277 RCE via calcext:data-mappings, sql provider and jdbc connector

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver for such a link to be loaded from a remote location, so opening the document could run Java code from that location. In fixed versions an entry in...

CVE-2026-63277

LibreOffice Calc is vulnerable to Remote Code Execution (RCE) when opening a document that links a cell range to an external data source. An attacker can craft a document naming a Java database driver to be loaded from a remote location, causing the application to execute Java code from that sour...

CVE-2026-63277 RCE via calcext:data-mappings, sql provider and jdbc connector

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver for such a link to be loaded from a remote location, so opening the document could run Java code from that location. In fixed versions an entry in...