CVE-2024-44541

CVE-2024-44541: Inventio Lite v4 में SQL Injection भेद्यता विवरण Inventio Lite v4, /action=processlogin एंडपॉइंट में SQL Injection SQLi के प्रति संवेदनशील है। यह भेद्यता हमलावरों को POST अनुरोधों में username पैरामीटर के माध्यम से मनमाना SQL क्वेरी इंजेक्ट करने की अनुमति देती है, जिससे अनधिकृत...

CVE-2022-37201

CVE-2022-37201 CVE-2022-37201 POC POC सबसे पहले, आपको sqlmap इंस्टॉल करना चाहिए आपको सेट करने की आवश्यकता है लक्ष्य डोमेन या IP आपका कुकी फिर शेल चलाएँ root@kitploit: sqlmap -u http://targetDomainOrIP/jfinalcms/jfinalcms/admin/contact/list --thread 8 --batch --smart --random-agent --data "...

discuz-ml-rce

discuz-ml-rce प्रभावित सिस्टम और संस्करण: Discuz!ML V3.2-3.4 Discuz!x V3.2-3.4 भेद्यता का कारण: Discuz!ML सिस्टम cookie में l द्वारा प्राप्त language पैरामीटर की सामग्री को फ़िल्टर नहीं करता है, जिससे स्ट्रिंग संयोजन string concatenation होता है और PHP कोड निष्पादित होता है। cookie फ़ील्ड में...

pharmacy-sqli-CVE-2026-7392

फार्मेसी विक्रय और इन्वेंट्री सिस्टम 1.0 - CVE-2026-7392 SQL इंजेक्शन SourceCodester फार्मेसी विक्रय और इन्वेंट्री सिस्टम V1.0 शुद्ध PHP/MySQL संस्करण CVE : CVE-2026-7392 एंडपॉइंट : /ajax.php?action=deletesupplier id पैरामीटर प्रकार : SQL इंजेक्शन CWE-89 CVSS 3.1 : 6.3 मध्यम लेखक : oretnom23...

EUVD-2026-65396

SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with access to Hive Metastore APIs to read, modify, or affect unintended partition metadata including statistics updates, truncation targets, and...

CVE-2026-71935

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the webBackupAction function. The vulnerability is caused by repeated string concatenation of the pathN, valueN, key, and option fields into fixed-size stack buffers without total length checks. A remote attacker can...

EUVD-2026-64994

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the webBackupAction function. The vulnerability is caused by repeated string concatenation of the pathN, valueN, key, and option fields into fixed-size stack buffers without total length checks. A remote attacker can...

CVE-2026-63038 Apache InLong: SQL Injection via String Concatenation Vulnerability Report

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This allows an attacker to inject arbitrary SQL code through the dbName, tableName, schemaName, and username parameters. This issue affects Apache InLong: from 2.0.0 before 2.4.0...

CVE-2026-56755

Denial of Service CPU & Memory Exhaustion via ON^2 String Concatenation in Debian Package Upload...

EUVD-2026-58146

Denial of Service CPU & Memory Exhaustion via ON^2 String Concatenation in Debian Package Upload...

CVE-2026-56755 Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload

Denial of Service CPU & Memory Exhaustion via ON^2 String Concatenation in Debian Package Upload...

CVE-2026-56755

Summary: CVE-2026-56755 is a DoS vulnerability in Gitea related to Denial of Service (CPU and memory exhaustion) caused by O(N^2) string concatenation during Debian package upload. The vulnerability is exploitable locally (attack vector: LOCAL) and is described with an impact of high availability...

CVE-2026-56755 Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload

Denial of Service CPU & Memory Exhaustion via ON^2 String Concatenation in Debian Package Upload...

CVE-2026-59109

Summary: CVE-2026-59109 concerns the Zalktis accounting application, where SQL injection can be triggered via trading-partner‑controlled fields in received electronic invoices. What is affected: Zalktis before 2026.1.586 and before 2026.2.592. The issue occurs when importing a received e‑invoice ...

EUVD-2026-58133

SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in received electronic invoices. When importing a received e-invoice UBL/PEPPOL or an e-commerce export, Zalktis concatenates partner-controlled values directly into SQL statement text using string...

crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate

A flaw was found in golang. A remote attacker could exploit this vulnerability by providing a specially crafted certificate during the error string construction process within the HostnameError.Error function. This flaw, caused by unbounded string concatenation, leads to excessive resource...

CVE-2026-16022

@oblique/cli 15.4.0 contains an OS command injection vulnerability in the project creation functionality. The CLI constructs shell commands through string concatenation and executes them with execSync. A user-controlled project-name argument is inserted into the shell command without proper...

EUVD-2026-53335

@oblique/cli 15.4.0 contains an OS command injection vulnerability in the project creation functionality. The CLI constructs shell commands through string concatenation and executes them with execSync. A user-controlled project-name argument is inserted into the shell command without proper...

CVE-2026-71248 Inventory-Management-System-PHP - Unauthenticated SQL Injection in Login and Product Deletion

Inventory-Management-System-PHP's login.php constructs its authentication query via direct string concatenation of raw POST parameters: = "select from user where email = '' and password = ''", with no escaping or parameterization, allowing authentication bypass via a payload such as email=' OR 1=...

CVE-2026-71243

The backmeup npm package assembles shell command strings by directly concatenating its option values name, source, destination, filter - e.g. cmd = "mkdir -p " + path.joininfo.destination, info.name + "; " - and executes the resulting string through a shell via ssh2-exec locally via childprocess,...