CVE-2026-27470-POC

CVE-2026-27470 — ZoneMinder 2차 SQL 인젝션 PoC 작성자:d3vn0mi | CVSS 8.8 | 인증 필요 | Events 권한 필요 개요 CVE-2026-27470은 ZoneMinder의 web/ajax/status.php — 구체적으로 getNearEvents 함수에서 발생하는 2차 SQL 인젝션 취약점입니다. 세부 사항| 값 ---|--- 영향 버전| ZoneMinder = 1.36.37 및 1.37.61 – 1.38.0 수정 버전| 1.36.38 / 1.38.1 유형| 2차 SQL 인젝션 인증...

CVE-2026-27470

ZoneMinder is a free, open source closed-circuit television software application. In versions 1.36.37 and below and 1.37.61 through 1.38.0, there is a second-order SQL Injection vulnerability in the web/ajax/status.php file within the getNearEvents function. Event field values specifically Name a...

CVE-2026-27470: Improper Neutralization of Special Elements used in an SQL Command

ZoneMinder is a free, open source closed-circuit television software application. In versions 1.36.37 and below and 1.37.61 through 1.38.0, there is a second-order SQL Injection vulnerability in the web/ajax/status.php file within the getNearEvents function. Event field values specifically Name a...

CVE-2025-71166: Improper Neutralization of Input During Web Page Generation

Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting XSS vulnerability in the administrative interface within the Tools Status move message handling. The path parameter is reflected into the HTML output without proper output encoding in...

CVE-2025-71165: Improper Neutralization of Input During Web Page Generation

Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting XSS vulnerability in the administrative interface within the Tools Status functionality. The path parameter is reflected into the HTML response without proper output encoding in include/admin/Tools/Status.php...

EUVD-2020-30160

Malware in sbrugna...

EUVD-2025-5427

Malicious code in bioql PyPI...

CVE-2025-5974

A vulnerability, which was classified as problematic, has been found in PHPGurukul Restaurant Table Booking System 1.0. Affected by this issue is some unknown functionality of the file /check-status.php. The manipulation of the argument searchdata leads to cross site scripting. The attack may be...

CVE-2025-5974

The CVE-2025-5974 entry applies to PHPGurukul Restaurant Table Booking System 1.0. A vulnerability in /check-status.php arises from unsafely handling the searchdata parameter, enabling cross-site scripting. The issue could be exploited remotely and, according to public disclosures, the exploit is...

CVE-2025-5974 PHPGurukul Restaurant Table Booking System check-status.php cross site scripting

A vulnerability, which was classified as problematic, has been found in PHPGurukul Restaurant Table Booking System 1.0. Affected by this issue is some unknown functionality of the file /check-status.php. The manipulation of the argument searchdata leads to cross site scripting. The attack may be...

CVE-2025-5974: Improper Neutralization of Input During Web Page Generation

A vulnerability, which was classified as problematic, has been found in PHPGurukul Restaurant Table Booking System 1.0. Affected by this issue is some unknown functionality of the file /check-status.php. The manipulation of the argument searchdata leads to cross site scripting. The attack may be...

CVE-2024-51101: Improper Neutralization of Special Elements used in an SQL Command

PHPGURUKUL Restaurant Table Booking System using PHP and MySQL v1.0 was discovered to contain a SQL injection vulnerability via the searchdata parameter at /rtbs/check-status.php...

CVE-2024-51101

PHPGURUKUL Restaurant Table Booking System using PHP and MySQL v1.0 was discovered to contain a SQL injection vulnerability via the searchdata parameter at /rtbs/check-status.php...

CVE-2020-9339

SOPlanning 1.45 allows XSS via the Name or Comment to status.php...

CVE-2019-8429

ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php filterQueryterms0cnj parameter...

CVE-2025-4491

A vulnerability classified as critical was found in Campcodes Online Food Ordering System 1.0. This vulnerability affects unknown code of the file /routers/ticket-status.php. The manipulation of the argument ticketid leads to sql injection. The attack can be initiated remotely. The exploit has be...

CVE-2025-4491 Campcodes Online Food Ordering System ticket-status.php sql injection

A vulnerability classified as critical was found in Campcodes Online Food Ordering System 1.0. This vulnerability affects unknown code of the file /routers/ticket-status.php. The manipulation of the argument ticketid leads to sql injection. The attack can be initiated remotely. The exploit has be...

CVE-2025-4491: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability classified as critical was found in Campcodes Online Food Ordering System 1.0. This vulnerability affects unknown code of the file /routers/ticket-status.php. The manipulation of the argument ticketid leads to sql injection. The attack can be initiated remotely. The exploit has be...

CVE-2025-21626

GLPI is a free asset and IT management software package. Starting in version 0.71 and prior to version 10.0.18, an anonymous user can fetch sensitive information from the status.php endpoint. Version 10.0.18 contains a fix for the issue. Some workarounds are available. One may delete the status.p...

CVE-2025-21626

GLPI is an asset/IT management product vulnerable up to version 10.0.18 due to an anonymous user able to fetch sensitive data from status.php. The issue is fixed in 10.0.18; mitigations include deleting status.php, restricting access, or sanitizing sensitive values in LDAP directories and related...