data_types_exposed:api_tokens × latest_source_host:yokai.hakaisecurity.io × limpar

Resultados

2 casos · pág. 1/1

yokai.hakaisecurity.io · há 2d high

CVE-2026-40083: Authenticated SQL Injection in Cacti <= 1.2.30 managers.php Exposes Full Database

The Yokai research team at Hakai Security disclosed CVE-2026-40083, a SQL injection vulnerability in Cacti versions up to and including 1.2.30. An authenticated user with SNMP management (agent) permissions can run arbitrary SQL queries, reading or modifying the entire database. Exposed data includes bcrypt credential hashes, API tokens, …

CVE-2026-40083

yokai.hakaisecurity.io · há 2d high

CVE-2026-44706: SQL Injection in Chatwoot FilterService lets any agent dump the PostgreSQL database

The Hakai Security Research Team disclosed CVE-2026-44706, a SQL Injection in Chatwoot versions <= 4.11.1. Any authenticated user with agent privileges, the lowest access level, can read the entire PostgreSQL database. The flaw sits in the FilterService, where user input is interpolated directly into SQL. Exposed data includes bcrypt pass…

CVE-2026-44706