220029 matches found
CVE-2026-72599 e107 e107 - SQL Injection
An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attackers to execute arbitrary SQL via the news item page ID parameter. The parameter is concatenated without escaping into a SQL WHERE clause. An unauthenticated attacker can read, modify, or delete all database contents...
CVE-2026-72562
CVE-2026-72562 affects Pimcore’s admin-ui-classic-bundle (through version 2.3). Affected: DataObject grid id column filter allows an SQL injection because the filter value is concatenated into the SQL WHERE clause without parameterization. Root cause: improper handling of filter input in backend ...
CVE-2026-72562 Pimcore pimcore admin-ui-classic-bundle - SQL Injection
An SQL injection vulnerability in Pimcore admin-ui-classic-bundle through version 2.3 allows authenticated backend users to execute arbitrary SQL via the DataObject grid id column filter. The filter value is concatenated directly into the SQL WHERE clause without parameterization. An attacker wit...
EUVD-2026-56032
An SQL injection vulnerability in Pimcore admin-ui-classic-bundle through version 2.3 allows authenticated backend users to execute arbitrary SQL via the DataObject grid id column filter. The filter value is concatenated directly into the SQL WHERE clause without parameterization. An attacker wit...
CVE-2026-72562
An SQL injection vulnerability in Pimcore admin-ui-classic-bundle through version 2.3 allows authenticated backend users to execute arbitrary SQL via the DataObject grid id column filter. The filter value is concatenated directly into the SQL WHERE clause without parameterization. An attacker wit...
CVE-2026-72562 Pimcore pimcore admin-ui-classic-bundle - SQL Injection
An SQL injection vulnerability in Pimcore admin-ui-classic-bundle through version 2.3 allows authenticated backend users to execute arbitrary SQL via the DataObject grid id column filter. The filter value is concatenated directly into the SQL WHERE clause without parameterization. An attacker wit...
CVE-2026-72558 CiviCRM CiviCRM - SQL Injection
An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The clause concatenates a user-supplied value into the SQL query without sanitization. An attacker with staff-level access can exfiltrate all...
CVE-2026-72558 CiviCRM CiviCRM - SQL Injection
An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The clause concatenates a user-supplied value into the SQL query without sanitization. An attacker with staff-level access can exfiltrate all...
CVE-2026-72558
CVE-2026-72558 affects CiviCRM up to 6.18.alpha1. An SQL injection exists in the contact search RLIKE clause, where user-supplied input is concatenated into the SQL query, enabling authentication-level staff to read the entire database and exfiltrate data such as donor and member records. The con...
EUVD-2026-56028
An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The clause concatenates a user-supplied value into the SQL query without sanitization. An attacker with staff-level access can exfiltrate all...
CVE-2026-72558
An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The clause concatenates a user-supplied value into the SQL query without sanitization. An attacker with staff-level access can exfiltrate all...
CVE-2026-72550 Friendica Friendica - SQL Injection
An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view order parameter. The parameter is concatenated unescaped into a SHOW COLUMNS query via a bare PDO::query call, enabling stacked...
EUVD-2026-56020
An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view order parameter. The parameter is concatenated unescaped into a SHOW COLUMNS query via a bare PDO::query call, enabling stacked...
CVE-2026-72550
CVE-2026-72550 : In Friendica (through the 2026.08-dev branch) an unauthenticated attacker can cause arbitrary SQL execution via the photo-view order parameter. The parameter is concatenated unescaped into a SHOW COLUMNS query through a bare PDO::query() call, enabling stacked statement injection...
CVE-2026-72550
An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view order parameter. The parameter is concatenated unescaped into a SHOW COLUMNS query via a bare PDO::query call, enabling stacked...
WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Taylsec in WordPress Plugin WP Directory Kit versions = 1.5.4...
RHSA-2026:52978 Red Hat Security Advisory: postgresql-jdbc security update
Bulletin has no description...
RHSA-2026:52930 Red Hat Security Advisory: postgresql-jdbc security update
Bulletin has no description...