CVE-2025-71428

Jivejdon through 5.0 contains a sql injection vulnerability in AccountDaoSql.getAccountByNameLike that allows authenticated administrators to inject SQL via the username parameter. Attackers with the Admin role can submit crafted input to /admin/user/userListAction to read database contents,...

CVE-2025-71428

Versions of Jivejdon through 5.0 are vulnerable to a SQL injection flaw in the AccountDaoSql.getAccountByNameLike() method. Authenticated users with the Admin role can exploit this by submitting crafted input to the /admin/user/userListAction endpoint via the username parameter . Successful explo...

CVE-2025-71428 Jivejdon through 5.0 SQL Injection via username in userListAction

Jivejdon through 5.0 contains a sql injection vulnerability in AccountDaoSql.getAccountByNameLike that allows authenticated administrators to inject SQL via the username parameter. Attackers with the Admin role can submit crafted input to /admin/user/userListAction to read database contents,...

CVE-2025-71428 Jivejdon through 5.0 SQL Injection via username in userListAction

Jivejdon through 5.0 contains a sql injection vulnerability in AccountDaoSql.getAccountByNameLike that allows authenticated administrators to inject SQL via the username parameter. Attackers with the Admin role can submit crafted input to /admin/user/userListAction to read database contents,...

CVE-2026-80381 Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute unauthorized SQL statements due to SQL injection...

CVE-2026-80381

IBM Guardium Data Protection versions 12.0, 12.1, and 12.2 are vulnerable to a SQL injection flaw within the Sniffer component . This vulnerability (CWE-89) could allow a remote attacker to execute unauthorized SQL statements . To remediate this, IBM strongly recommends applying the latest Sniffe...

CVE-2026-81932

IBM Guardium Data Protection versions 12.0 , 12.1 , and 12.2 are vulnerable to an SQL injection (CWE-89) within the Sniffer component . A remote unauthenticated attacker could send specially crafted SQL statements to view, add, modify, or delete information in the back-end database. To remediate ...

CVE-2026-16830

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to modify data and cause a denial of service due to an SQL injection vulnerability...

CVE-2026-24416

CVE-2026-24416: OpenSTAManager يحتوي على ثغرة حقن SQL الأعمى القائم على الوقت في وحدة تسعير المقالات نظرة عامة الحقل| التفاصيل ---|--- معرف CVE| CVE-2026-24416 الخطورة| عالية التوصية الأمنية| عرض التوصية اكتُشفت بواسطة| Lukasz Rybak المنتجات المتأثرة devcode-it/openstamanager الإصدارات: = 2.9.8...

CVE-2026-16830

An SQL injection vulnerability (CWE-89 ) exists in IBM Security Verify Access (versions 10.0 through 10.0.9.2) and IBM Verify Identity Access (versions 11.0 through 11.0.3). A remote authenticated attacker could exploit this flaw to modify data and trigger a denial of service . To remediate, IBM ...

CVE-2026-16830 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to modify data and cause a denial of service due to an SQL injection vulnerability...

EUVD-2026-95281

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to modify data and cause a denial of service due to an SQL injection vulnerability...

CVE-2026-2413

CVE-2026-2413 Ally – Web Accessibility & Usability = 4.0.3 - Injection SQL non authentifiée via le chemin de l'URL Description Le plugin Ally – Web Accessibility & Usability pour WordPress est vulnérable à l'injection SQL via le chemin de l'URL dans toutes les versions jusqu'à la version 4.0.3...

CVE-2026-78070

Injection SQL via Shortcode ORDER BY dans plgcontentdpcalendar DPCalendar Free ≤ 10.11.2 — Un utilisateur de niveau Auteur extrait l'intégralité de la base de données via une injection aveugle basée sur le temps RÉSUMÉ Le plugin de contenu plgcontentdpcalendar analyse les shortcodes events...

CVE-2026-24419

CVE-2026-24419: حقن SQL في وحدة Prima Nota في OpenSTAManager نظرة عامة الحقل| التفاصيل ---|--- معرف CVE| CVE-2026-24419 الخطورة| عالية النشرة الأمنية| عرض النشرة اكتُشف بواسطة| Lukasz Rybak المنتجات المتأثرة devcode-it/openstamanager الإصدارات: = 2.9.8 تصنيف CWE CWE-89: عدم التعامل السليم مع...

CVE-2026-33910_SqlInjectionVulnerabilityOpenEMR8.0.0.2

CVE-2026-33910 - ثغرة حقن SQL في OpenEMR الضعف CWE-89 تحييد غير سليم للعناصر الخاصة المستخدمة في أمر SQL 'حقن SQL' يبني المنتج كل أمر SQL أو جزءًا منه باستخدام مدخلات متأثرة خارجيًا من مكوّن علوي upstream component، لكنه إما لا يحيد أو يحيد بشكل غير صحيح العناصر الخاصة التي قد تعدّل أمر SQL المقص...

sqli-hunter-CVE-2024-51482-PoC

sqli-hunter-CVE-2024-51482-PoC سكربتات بايثون لاستغلال CVE-2024-51482 حقن SQL في ZoneMinder — HTB CCTV sqli-hunter — CVE-2024-51482 الوصف يعمل هذا السكربت على أتمتة استخراج قواعد البيانات والجداول والأعمدة وبيانات الاعتماد باستغلال CVE-2024-51482، وهي ثغرة حقن SQL قائمة على الاستجابات المنطقية...

CVE-2025-10351-POC

CVE-2025-10351 POC - استغلال حقن SQL 💉 POC لـ CVE-2025-10351: ثغرة حقن SQL غير مصادق عليها تؤثر على نقطة نهاية محددة في إطار عمل Melis Platform. 🔗 المراجع 📄 CVE-2025-10351 على MITRE 📄 تحذير منصة Melis على INCIBE المعهد الإسباني للأمن السيبراني 🚀 الوصف يستهدف هذا POC ثغرة حقن SQL غير مصادق عليها...

Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities.

Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-82896 DESCRIPTION: IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to traverse directories on the system due to a path traversal vulnerability...

GHSA-R3RV-JM3R-62Q2 MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES

Description When escaping string and binary parameters for the text protocol, the connector always escaped the quote character with a backslash, without ever consulting the session's NOBACKSLASHESCAPES SQL mode. The server status flag was declared STATUSNOBACKSLASHESCAPES but never read. Under a...