#sqlinjection — Public Fediverse posts

An Apache InLong SQL injection flaw, CVE-2026-63038, lets attackers inject SQL via multiple parameters. Two more bugs join it. Upgrade to 2.4.0.

#ApacheInLong #SQLInjection #CVE #SSRF #InfoSec #OpenSource

https://securityonline.info/apache-inlong-sql-injection-cve-2026-63038/?utm_source=mastodon&utm_medium=jetpack_social

🔍 Testing SQL Injection Security with ANDRAX

ANDRAX brings powerful security assessment tools directly to Android. In this Reel, I test my own website to demonstrate how an SQL Injection vulnerability can be identified and why proper web security matters.

💬 Comment "ANDRAX" and I'll share more cybersecurity resources.

#CyberSecurity #ANDRAX #WebSecurity #SQLInjection #InfoSec

Oracle Exploited: Attackers Turn SQL Injection into Windows SYSTEM Access

Attackers have successfully exploited a SQL injection vulnerability to gain unprecedented access to Oracle databases, converting it into a Windows SYSTEM-level access with alarming ease. This rare and sophisticated technique has allowed hackers to deploy a custom toolkit, dubbed khunt, that turns database-stored Java…

https://osintsights.com/oracle-exploited-attackers-turn-sql-injection-into-windows-system-access?utm_source=mastodon&utm_medium=social

#SqlInjection #Oracle #Java #WindowsPrivilegeEscalation #SupplyChainAttack

How Bad Was The PeerTube Exploit?

https://video.fedihost.co/w/7EZonYEQnWtiKtqcd3nFSf

If you're looking at the #Wordpress PoC for https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q at https://github.com/attackercan/wp2shell-poc2 , please be aware that the "check" and "read" PoC do not always work. I assume it was created on an empty Wordpress install (with 0 posts). But if it's populated, the OR SLEEP(3) is short circuited away. Trust your version.php instead.

(wp2shell-poc does not have an issue tracker enabled to report this to.)

#sqlinjection #vulnerability #cve #infosec

🚨 wp2shell affects multiple vulnerabilities (CVE-2026-63030, CVE-2026-60137).

- CVE-2026-63030 (HIGH) - WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
- CVE-2026-60137 (CRITICAL) - WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

Running WordPress? Check your versions and patch to 6.8.6 / 6.9.5 / 7.0.2. If you can't patch immediately, apply the mitigations in the meantime.

ℹ️ Additional information on ZEN SecDB
https://secdb.nttzen.cloud/updates/a5a57351-ee12-401e-89a9-eca20d3ba7af/wp2shell-vulnerability

#infosec #wordpress #rce #sqlinjection #cve202663030 #cve202660137
#nttdata #zen #secdb #vulnerability_intelligence

CVE-2026-1207 is a Django SQL injection flaw (CVSS 8.3) in PostGIS raster lookups. Canada's CCCS says it is exploited in the wild. Patch now.

#Django #SQLInjection #CVE20261207 #PostGIS #InfoSec

https://securityonline.info/django-sql-injection-cve-2026-1207/?utm_source=mastodon&utm_medium=jetpack_social

A look at CVE-2020-24932, the critical SQL injection in Complaint Management System v1.0 that allowed full database disclosure through a single parameter. https://hackernoon.com/anatomy-of-a-critical-sql-injection-lessons-from-cve-2020-24932 #sqlinjection

#Roundcube-Webmail-Instanzen mit Schadcode attackierbar | Security https://www.heise.de/news/Roundcube-Webmail-Instanzen-mit-Schadcode-attackierbar-11307545.html #Patchday #SQLinjection #XSS #CrossSiteScripting

Jetzt patchen! Angreifer nutzen kritische Schadcode-Lücke in #Drupal aus | Security https://www.heise.de/news/Jetzt-patchen-Angreifer-nutzen-kritische-Schadcode-Luecke-in-Drupal-aus-11305870.html #Patchday #exploit #SQLinjection #PostgreSQL #CMS #ContentManagementSystem

#Drupal: Critical #SQLInjection flaw now targeted in attacks

https://www.bleepingcomputer.com/news/security/drupal-critical-sql-injection-flaw-now-targeted-in-attacks/

#cybersecurity #SQL

Drupal Sites Targeted in SQL Injection Attacks

Drupal sites are under attack as SQL injection exploits are now being detected in the wild, taking advantage of a vulnerability that can be triggered without authentication. This critical flaw, CVE-2026-9082, allows attackers to execute arbitrary SQL and potentially run remote code, putting sites that use PostgreSQL at risk.

https://osintsights.com/drupal-sites-targeted-in-sql-injection-attacks?utm_source=mastodon&utm_medium=social

#SqlInjection #Drupal #Cve20269082 #EmergingThreats #ArbitraryCodeExecution

Patch immediately before public exploits emerge.

https://www.drupal.org/sa-core-2026-004

Affected:

- 8.9.0 , < 10.4.10
- 10.5.0 , < 10.5.10
- 10.6.0 , < 10.6.9
- 11.0.0 , < 11.1.10
- 11.2.0 , < 11.2.12
- 11.3.0 , < 11.3.10

CVE-2026-9082 - Highly critical - SQL Injection
CVE-2026-8495 - Missing Authorization
CVE-2026-8493 - XSS
CVE-2026-8492
CVE-2026-8491

#Drupal #PHP #CyberSecurity #Infosec #CVE #WebSecurity #PostgreSQL #SqlInjection #PrivilegeEscalation #XSS

#PostgreSQL: Updates stopfen hochriskante Sicherheitslecks | Security https://www.heise.de/news/PostgreSQL-Updates-stopfen-hochriskante-Sicherheitslecks-11297485.html #SQL #Patchday #SQLinjection

🚨 CRITICAL: CVE-2026-46364 in phpMyFAQ <4.1.2 allows unauthenticated SQL injection via /api/captcha. Attackers can exfiltrate user creds, admin tokens, and SMTP info. Restrict endpoint & use WAF until patch is confirmed. https://radar.offseq.com/threat/cve-2026-46364-improper-neutralization-of-special--9adafcbf #OffSeq #SQLInjection #Infosec

#SAP-#Patchday: Kritische Sicherheitslücken erlauben unbefugte Anmeldung | Security https://www.heise.de/news/SAP-Patchday-Kritische-Sicherheitsluecken-erlauben-unbefugte-Anmeldung-11291173.html #SQLinjection

🚨 CRITICAL: SQL injection (CVE-2026-34260, CVSS 9.6) in SAP S/4HANA (SAP_BASIS 751-816). Authenticated attackers can access sensitive data & crash apps. No patch yet — restrict access & monitor logs. https://radar.offseq.com/threat/cve-2026-34260-cwe-89-improper-neutralization-of-s-4864cd58 #OffSeq #SAP #Infosec #SQLInjection

Oh, another groundbreaking article promising to unravel Intel's secret #voodoo memory #tech, only to be thwarted by the mighty #Cloudflare shield. 🤦‍♂️ Because who needs cutting-edge insights when you can play "Guess the SQL Injection"? 🚀💻
https://www.hpcwire.com/2026/02/05/what-is-z-angle-memory-and-why-is-intel-developing-it/ #Intel #SQLInjection #TechNews #HackerNews #ngated

#ProFTPD: Codeschmuggel durch mod_sql möglich | Security https://www.heise.de/news/ProFTPD-Codeschmuggel-durch-mod-sql-moeglich-11277942.html #Patchday #SQLinjection

#SAP-#Patchday: Eine kritische #SQLInjection-Lücke – und 18 weitere | Security https://www.heise.de/news/SAP-Patchday-Eine-kritische-SQL-Injection-Luecke-und-18-weitere-11256627.html

Angreifer knacken #Gambio-Webshops – Updates verfügbar | Security https://www.heise.de/news/Updaten-Angriffe-auf-Gambio-Webshops-11229519.html #Patchday #exploit #SQLinjection

Over 200,000 #WordPress sites are exposed due to an SQL injection flaw in the Ally plugin (CVE-2026-2413), allowing attackers to extract database data. Patch released, but many sites remain vulnerable.

Read: https://hackread.com/sql-injection-vulnerability-ally-wordpress-plugin/

#CyberSecurity #SQLInjection #Vulnerability

https://codewall.ai/blog/how-we-hacked-mckinseys-ai-platform

"The agent mapped the attack surface and found the API documentation publicly exposed — over 200 endpoints, fully documented. Most required authentication. Twenty-two didn't.

One of those unprotected endpoints wrote user search queries to the database. The values were safely parameterised, but the JSON keys — the field names — were concatenated directly into SQL."

Read and write access to everything.

#mckinsey #security #ai #sqlinjection

Automatisierungs-Tool #n8n: Angreifer können Schadcode einschleusen | Security https://www.heise.de/news/Automatisierungs-Tool-n8n-Updates-stopfen-Codeschmuggel-Lecks-11190464.html #malware #XSS #CrossSiteScripting #SQLinjection

What's wrong with this SQL IN clause?

What's wrong with this SQL IN clause in a permissions check. The SQL code builds an IN list from user input without parameterization. In SQL services this enables injection and data leaks.

#whatswrongwiththissqlquery #sqlbug #sqlproductionbug #sqldebugging #sqldatabase #sqlcodereview #sqlperformance #sqlreliability #sqlanalytics #sqldataintegrity #sqlengineering #sqlinjection #sqlinclause #sqlsecurity #sqlper...

https://www.youtube.com/watch?v=YtxP2ye7rJ4