240521 matches found
BIT-POSTGRESQL-2026-18024 PostgreSQL ascii() function reads past end of buffer
Buffer over-read in PostgreSQL ascii SQL function allows a user to disclose up to 3 bytes after the end of a specific allocation, via a crafted text value. This is the same class of defect that CVE-2026-2006 fixed, though this instance has less impact. Versions before PostgreSQL 18.5, 17.11, 16.1...
BIT-POSTGRESQL-2026-15742 PostgreSQL fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound
Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL function levenshtein or levenshteinlessequal. Versions before PostgreSQL 18.5, 17.11,...
BIT-POSTGRESQL-2026-15741 PostgreSQL expression deparse allows SQL injection via EXTRACT argument
SQL injection in PostgreSQL EXTRACT deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pgdump, psql commands like \sf, and any similar usage in non-core tools. Versions before...
BIT-POSTGRESQL-2026-14673 PostgreSQL amcheck does not clear untrusted search path
Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes that depend on the search path, via setting a hostile search path before calling the amcheck function. Within major versions 18, 16...
WordPress Total Donations plugin <= 2.0.5 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Total Donations versions = 2.0.5...
CVE-2024-40498
CVE-2024-40498 Aplicação Afetada online-shopping-system-advanced 1.0 https://github.com/PuneethReddyHC/online-shopping-system-advanced Descrição O arquivo register.php lida com o registro de usuários. Na linha 117, os parâmetros POST "$address1" e "$address2" não são sanitizados, ao contrário do...
SimpleCTF-UpdatedExploit
CMS Made Simple = 2.2.10 SQL-Injection-Exploit Überblick Dieses Python-Skript nutzt eine nicht authentifizierte SQL-Injection-Sicherheitslücke in CMS Made Simple = 2.2.10 CVE-2019-9053 aus. Der Exploit extrahiert vertrauliche Informationen wie Salt, Benutzernamen, E-Mail und Passwort des...
CVE-2022-28346
CVE-2022-28346 SQL-Injection in Django QuerySet.annotate, aggregate, extra Initialisierung der Umgebung root@kitploit: 1.python manage.py makemigrations 2.python manage.py migrate 3. Rufe http://x.x.x.x:8000/ auf und füge Initialisierungsdaten ein Reproduktion der Schwachstelle root@kitploit: Ruf...
WordPress Maps Marker Pro plugin <= 4.32 - SQL Injection vulnerability
SQL Injection vulnerability discovered by johska in WordPress Plugin Maps Marker Pro versions = 4.32...
CVE-2026-16950
The Product Shortlist WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks...
CVE-2026-12983
The Dinatur WordPress plugin through 1.18 does not sanitize and escape user input before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks. The same handler also performs a database table truncation without any authorization check, allowing any unauthenticat...
EUVD-2026-62273
The Product Shortlist WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks...
CVE-2026-16950
The Product Shortlist WordPress plugin (≤1.0.4) exposes an unauthenticated SQL injection flaw in the get_shortlisted_products function. A parameter is passed unsanitised into a SQL query, enabling remote attackers to extract database contents. CVSS 3.1 scores this HIGH (8.6, AV:N/AC:L/PR:N/UI:N)....
CVE-2026-16950 Product Shortlist <= 1.0.4 - Unauthenticated SQL Injection via get_shortlisted_products
The Product Shortlist WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks...
CVE-2026-12983 Dinatur <= 1.18 - Unauthenticated SQL Injection via Column Name Injection
The Dinatur WordPress plugin through 1.18 does not sanitize and escape user input before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks. The same handler also performs a database table truncation without any authorization check, allowing any unauthenticat...
CVE-2026-12983 Dinatur <= 1.18 - Unauthenticated SQL Injection via Column Name Injection
The Dinatur WordPress plugin through 1.18 does not sanitize and escape user input before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks. The same handler also performs a database table truncation without any authorization check, allowing any unauthenticat...
CVE-2026-12983
The Dinatur WordPress plugin (≤1.18) has an unauthenticated SQL injection via unsanitized column-name input in a SQL query, enabling data exfiltration (CVSS 8.6 HIGH). The same handler also truncates database tables without authorization, allowing any visitor to wipe plugin data. No patch version...
EUVD-2026-62257
The Dinatur WordPress plugin through 1.18 does not sanitize and escape user input before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks. The same handler also performs a database table truncation without any authorization check, allowing any unauthenticat...
CVE-2026-76050
A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This impacts an unknown function of the file /admin/ajax.php?action=deletemenu. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been made...
CVE-2026-76049
A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affects an unknown function of the file /admin/ajax.php?action=savemenu. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been...