tag
Sqli
FreePBX Unauthenticated SQL Injection to RCE (CVE-2025-57819)
CVE-2025-57819 is an unauthenticated SQL injection in FreePBX's admin/ajax.php endpoint handler for the endpoint module, where the brand parameter is concatenated into a backend SQL query without sanitization. The PoC first confirms the injection with an…
WordPress Contest Gallery Plugin Unauthenticated Blind SQL Injection — CVE-2026-3180
The Contest Gallery WordPress plugin passes the cglmaili parameter through WordPress's sanitizeemail() function, which preserves the single-quote character (') in the local part of an email address. Because the sanitized value is subsequently used to build a…
The Events Calendar WordPress Plugin Unauthenticated Blind SQL Injection (CVE-2026-49772)
CVE-2026-49772.py is a full-featured blind SQL injection tool targeting an unauthenticated, unsanitized order parameter on The Events Calendar's experimental REST endpoint GET /wp-json/tec/v1/events. A broken REST parameter validator (validatecallback returns…
Sparx Enterprise Architect / Pro Cloud Server Unauthenticated Binary-Protocol SQL Injection (CVE-2026-42096)
Sparx Pro Cloud Server exposes a SparxCloudLink.sseap endpoint that accepts a proprietary binary protocol used by the Enterprise Architect desktop client to query the underlying repository database. Commands (including raw SQL query strings) are obfuscated…
Sequelize ORM JSON Cast SQL Injection — CVE-2026-30951
Sequelize v6's JSON/JSONB where-clause processing treats the portion of a JSON path key following a :: delimiter as a SQL cast type, inserting it into the generated SQL query without validation. If an application allows attacker-controlled JSON object keys to…
ProjeQtor Unauthenticated Login SQL Injection (CVE-2026-41462)
ProjeQtor's login.php endpoint concatenates the login POST parameter directly into a SQL query without sanitization, allowing an unauthenticated attacker to inject stacked SQL statements. The included exploit crafts a login value that terminates the original…
ProFTPD mod_sql Pre-Auth SQL Injection Leading to RCE (CVE-2026-42167)
CVE-2026-42167 is a pre-authentication SQL injection in ProFTPD's modsql logging support. The module's isescapedtext() sanitizer fails to properly neutralize input used to populate logging variables (such as %U), which are substituted into SQL statements…
Control Web Panel Pre-Auth Blind SQL Injection to RCE — CVE-2026-57517
Control Web Panel versions <= 0.9.8.1224 contain a pre-authentication blind SQL injection in the userRes POST parameter of the user panel endpoint (/{username}/). The backend query runs with MySQL root privileges, which hold the global FILE privilege,…
Business Directory Plugin for WordPress — Unauthenticated Time-Based Blind SQL Injection (CVE-2026-2576)
The Business Directory Plugin's ORM query builder (class-db-query-set.php) safely parameterizes scalar filter values with $wpdb->prepare(), but falls back to raw string concatenation whenever a filter value is an array. The plugin's checkout controller reads…
Drupal Core PostgreSQL SQL Injection (CVE-2026-9082)
CVE-2026-9082 is an unauthenticated SQL injection in Drupal Core's PostgreSQL entity-query handling for JSON:API filters. User-controlled array keys are used to build SQL placeholder names without proper sanitization, enabling injection into generated SQL. On…