CVE-2024-54820

취약점: 인증되지 않은 SQL 인젝션 - 평문 자격 증명 덤프 저자 : Javier Carabantes 영향 받는 소프트웨어 : XOne Web Monitor 소프트웨어 : https://xone.es/ 영향 받는 버전 : 02.10.2024.530 framework 1.0.4.9 설명 XOne Web Monitor 버전 02.10.2024.530 framework 1.0.4.9 의 로그인 기능에서 인증되지 않은 SQL 인젝션 취약점이 발견되었습니다. 이 결함으로 인해 공격자는 인증 과정에서 사용자 입력을 부적절하게 처리하는 ...

CVE-2026-30951

CVE-2026-30951 Sequelize JSON Cast SQL Injection ★ CVE-2026-30951 Sequelize ORM SQL Injection PoC ★ https://github.com/user-attachments/assets/30b19211-890a-4780-acd9-04856ec98381 개요 CVE-2026-30951 은 널리 사용되는 Node.js ORM인 Sequelize v6 의 SQL Injection 취약점입니다. 이 취약점은 JSON/JSONB where 절 처리 과정에 존재합니다...

CVE-2026-0603

CVE-2026-0603 Hibernate ORM 인젝션 / 2차 SQL 인젝션 ★ CVE-2026-0603 Hibernate SQL 인젝션 PoC ★ https://github.com/user-attachments/assets/2e7c3a89-e26f-48cd-af0b-8b82d32ce71f 개요 CVE-2026-0603 은 널리 사용되는 Java ORM 프레임워크인 Hibernate ORM 의 2차 SQL 인젝션 취약점입니다. 악성 SQL 페이로드가 포함된 사용자 제공 문자열 기본 키가 대량 DELETE 또는 UPDATE...

NocoBase - SQL Injection

NocoBase versions prior to 2.0.39 contain a SQL injection vulnerability in the @nocobase/database package. The queryParentSQL function in eager-loading-tree.ts constructs a recursive CTE query by directly concatenating user-controlled primary key values into the SQL WHERE IN clause without...

CVE-2025-6783

WHERE句に常に真となる条件を注入し、全ての行が一致するようにします: curl -i -X POST \ -H "Content-Type: application/json" \ -H "forms-id: poc-001' OR '1'='1' -- " \ -H "domain-id: example.com" \ -d ' "emabedtype":"iframe", "shortcodetitle":"INJECTED", "shortcodetag":"xss", "active":0 ' ...

RocketChat-NoSQLi-Chain-CVE-2021-22911

Rocket.Chat NoSQLi 토큰 유출 및 비밀번호 재설정 Rocket.Chat및 Meteor 기반 애플리케이션을 위한 자동화된 익스플로잇 스크립트로, $where 절을 이용한 NoSQL 인젝션 을 통해 서버 측 예외를 발생시켜 비밀번호 재설정 토큰을 유출합니다. 토큰이 유출되면 스크립트는 인증되지 않은 비밀번호 재설정을 수행합니다. 취약점 개요 1. 인증 : 스크립트는 일반 사용자로 인증하여 /api/v1/users.list 엔드포인트에 접근합니다. 2. NoSQL 인젝션 : query 파라미터를 사용하여 $where...

CVE-2026-30951

CVE-2026-30951 Sequelize JSON Cast SQL Injection ★ CVE-2026-30951 Sequelize ORM SQL Injection PoC ★ https://github.com/user-attachments/assets/30b19211-890a-4780-acd9-04856ec98381 개요 CVE-2026-30951 은 널리 사용되는 Node.js ORM인 Sequelize v6 의 SQL Injection 취약점입니다. 이 취약점은 JSON/JSONB where 절 처리 과정에 존재합니다...

BIT-GRAFANA-2026-19475 SQL Data Source Plugin: OOM DoS via $__timeGroup macro

An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory consumption that can...

CVE-2026-30951 — Updated!

CVE-2026-30951 Sequelize JSON Cast SQL Injection ★ CVE-2026-30951 Sequelize ORM SQL Injection PoC ★ https://github.com/user-attachments/assets/30b19211-890a-4780-acd9-04856ec98381 Overview CVE-2026-30951 is a SQL Injection vulnerability in Sequelize v6 , a widely used Node.js ORM. The vulnerabili...

CVE-2026-19475

Grafana is vulnerable to a denial of service via a bypass of the fix for CVE-2026-33375 . An authenticated user with permission to query a SQL data source can inject the timeGroup macro through a WHERE clause , which Grafana's regex-based macro parsing does not reject. Evaluating the injected mac...

CVE-2026-19475 SQL Data Source Plugin: OOM DoS via $__timeGroup macro

An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory consumption that can...

CVE-2026-19475: Uncontrolled Resource Consumption

An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory consumption that can...

WordPress Form Maker by 10Web plugin <= 1.15.44 - Authenticated (Subscriber+) SQL Injection via '{username}' Placeholder in Dynamic-Choice Field WHERE Clause vulnerability

Authenticated Subscriber+ SQL Injection via 'username' Placeholder in Dynamic-Choice Field WHERE Clause vulnerability discovered by R4mbb in WordPress Plugin Form Maker by 10Web versions = 1.15.44...

CVE-2026-15993

The Form Maker by 10Web WordPress plugin (vulnerable up to 1.15.44) is affected by a blind SQL Injection in the Dynamic-Choice Field WHERE clause that references the {username} placeholder. Root cause: insufficient escaping of the user-supplied parameter and inadequate preparation of the existing...

CVE-2026-70369

Koha's reports/acquisitionsstats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled Filter request parameters directly into WHERE fragments covering aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.homebranch, items.ccode,...

CVE-2026-65314: Observable Discrepancy

Electric Postgres Sync versions below 1.6.10 contains an information disclosure vulnerability that allows attackers to infer the values of excluded columns by crafting subset where clause conditions against shape responses. Attackers can observe whether subset where conditions match rows to deduc...

Duplicate Advisory: SurrealDB: Scraping a TABLE with no available PERMISSIONS to current auth level

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-98fx-66cf-fc7c. This link is maintained to preserve external references. Original Description SurrealDB before 3.1.0 evaluates user-supplied WHERE clauses in SELECT statements and SET/MERGE/CONTENT/PATCH clauses...

CVE-2026-63755

SurrealDB before 3.1.0 evaluates user-supplied WHERE clauses in SELECT statements and SET/MERGE/CONTENT/PATCH clauses in UPDATE, UPSERT, INSERT ON DUPLICATE KEY UPDATE, and RELATE update-variant statements against full record data before enforcing PERMISSIONS FOR SELECT WHERE restrictions. An...

EUVD-2026-45926

SurrealDB before 3.1.0 evaluates user-supplied WHERE clauses in SELECT statements and SET/MERGE/CONTENT/PATCH clauses in UPDATE, UPSERT, INSERT ON DUPLICATE KEY UPDATE, and RELATE update-variant statements against full record data before enforcing PERMISSIONS FOR SELECT WHERE restrictions. An...

CVE-2026-63755

CVE-2026-63755 affects SurrealDB prior to 3.1.0. The bug evaluates user-supplied WHERE clauses (and related clauses in UPDATE/UPSERT/INSERT/RELATE) against full record data before applying table-level permissions, allowing an authenticated user to read full contents of any table in the current da...