286979 matches found
CVE-2026-116807 OpenPanel before 3.0.0 ClickHouse SQL Injection via event.events tRPC Query
OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to bypass tenant scoping by injecting unescaped profile filter names into a JOIN subquery. Attackers can supply a crafted filter name with a trailing comment to bypass the projectid WHERE clause and rea...
CVE-2022-33171
CVE-2022-33171: TypeORM SQL Injection Note: This is a work-in-progress analysis of CVE-2022-33171. The details provided here may be updated as further information becomes available.currently not working Vulnerability Details CVE ID: CVE-2022-33171 Product: TypeORM Affected Versions: 0.3.0...
netgear-to-CVE-2022-29383
NETGEAR ProSafe SSL VPN CVE-2022-29383 to https://github.com/badboycxcc/Netgear-ssl-vpn-20211222-CVE-2022-29383 SQL injection vulnerability exists in scgi-bin/platform.cgi Firmware version： FVS318Gv2 and FVS318N FVS318Gv2 FVS318N...
cve-2026-9082-drupal-postgresql-rce
CVE-2026-9082 Drupal PostgreSQL SQLi to RCE This repository contains a local lab and a short exploit for the Drupal JSON:API PostgreSQL SQL injection described in the Ambionics article. The important part of the exploit is the PostgreSQL escalation: once the injection can evaluate a SELECT...
CVE-2026-116515
A security vulnerability has been detected in itsourcecode Online Book Store 1.0. This vulnerability affects unknown code of the file /book.php. The manipulation of the argument bookisbn leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed...
CVE-2026-116515 itsourcecode Online Book Store book.php sql injection
A security vulnerability has been detected in itsourcecode Online Book Store 1.0. This vulnerability affects unknown code of the file /book.php. The manipulation of the argument bookisbn leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed...
CVE-2026-116515
The itsourcecode Online Book Store 1.0 application is vulnerable to SQL injection within the /book.php file. The vulnerability is triggered by the manipulation of the bookisbn argument. This flaw can be exploited remotely, and an exploit has been disclosed publicly. No specific remediation or ver...
CVE-2026-116515 itsourcecode Online Book Store book.php sql injection
A security vulnerability has been detected in itsourcecode Online Book Store 1.0. This vulnerability affects unknown code of the file /book.php. The manipulation of the argument bookisbn leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed...
log-analyzer-ids
Log Analyzer / Lightweight IDS A Python tool that reads SSH...
CVE-2026-10757
There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with privileges to access the service which could, depending on the service being configured in a non-default access configuration “public”, include an...
CVE-2026-10757
A SQL injection vulnerability exists in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux . An attacker with access to the service—which could include an anonymous attacker if the service is configured with "public" access—can execute unauthorized database-specific functions. Patc...
EUVD-2026-110057
There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with privileges to access the service which could, depending on the service being configured in a non-default access configuration “public”, include an...
CVE-2026-10757 BUG-000187511 - ArcGIS Server has a security vulnerability.
There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with privileges to access the service which could, depending on the service being configured in a non-default access configuration “public”, include an...
CVE-2026-10757 BUG-000187511 - ArcGIS Server has a security vulnerability.
There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with privileges to access the service which could, depending on the service being configured in a non-default access configuration “public”, include an...
CVE-2026-115418
SQL injection in the database-query custom resource handlers in the Amazon Web Services AWS Cloud Development Kit CDK @aws-cdk/aws-redshift-alpha module before 2.274.0-alpha.0 could allow a third party who can influence construct property values to run SQL statements with Amazon Redshift superuse...
Grafana CVE-2024-9264 SQL Expressions RCE
CVE-2024-9264 Grafana 11.0.0–11.2.0: Viewer+ can run SQL Expressions with DuckDB readtext / shellfs for arbitrary file read and command execution when duckdb shellfs is available in PATH. !/usr/bin/env python3 -- coding: utf-8 -- """Grafana CVE-2024-9264 SQL Expressions DuckDB authenticated RCE /...
Joomla Simple Membership CVE-2026-102782 SQL injection
CVE-2026-102782 comsimplemembership 7.4.0: unauthenticated SQL injection on task=checkLoginPass via the login parameter. Uses error-based extractvalue to leak SQL subquery results leak. !/usr/bin/env python3 -- coding: utf-8 -- """Joomla OrdaSoft Simple Membership CVE-2026-102782 unauth SQLi."""...
Metabase CVE-2026-72898 SQLi Detect
Probes POST /api/session/resetpassword for undeclared user-id :raw acceptance and optional pgsleep timing oracle. !/usr/bin/env python3 -- coding: utf-8 -- """Metabase CVE-2026-72898 resetpassword SQLi detection.""" from future import annotations import json import re import time from kittysploit...
Magento CVE-2015-1397 Shoplift Detect
Fingerprints Magento and probes CmsWysiwyg/directive/index for SUPEE-5344 missing stacked SQLi sink. !/usr/bin/env python3 -- coding: utf-8 -- """Magento CE CVE-2015-1397 Shoplift SQLi surface detect.""" import base64 from kittysploit import from lib.protocols.http.httpclient import Httpclient...
WordPress Unlimited Elements CVE-2026-103355 detect
Detects Unlimited Elements for Elementor = 2.0.20 CVE-2026-103355: terms-listing widget may concatenate parent-term IDs into SQL unvalidated. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Unlimited Elements for Elementor CVE-2026-103355 exposure.""" from kittysploit import from...