Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query

Summary The V4StatisticsQuery handler passes the user-supplied rawquery field directly to DuckDB without calling the sqlvalidator.ValidateRawSQL function used throughout the rest of the codebase. Any authenticated user can execute arbitrary SQL statements against all data accessible through the...

EUVD-2026-94450

A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an authenticated, remote attacker to conduct SQL injection attacks against an affected application. This vulnerability is due to insufficient...

CVE-2026-76452 Cisco Smart Software Manager On-Prem SQL Injection Vulnerability

A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an authenticated, remote attacker to conduct SQL injection attacks against an affected application. This vulnerability is due to insufficient...

CVE-2026-76452

A vulnerability in the web-based management interface of Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem) allows an authenticated, remote attacker to conduct SQL injection attacks. This issue stems from insufficient validation of user-supplied input , where a crafted request ...

CVE-2026-76452 Cisco Smart Software Manager On-Prem SQL Injection Vulnerability

A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an authenticated, remote attacker to conduct SQL injection attacks against an affected application. This vulnerability is due to insufficient...

EUVD-2026-94522

Homer is open source telecom observability software. Prior to version 11.0.283, the V4StatisticsQuery handler passes the user-supplied rawquery field directly to DuckDB without calling the sqlvalidator.ValidateRawSQL function used throughout the rest of the codebase. Any authenticated user can...

CVE-2026-62251

Homer, an open-source telecom observability software, is vulnerable to SQL Injection (CWE-89) in versions prior to 11.0.283 . The V4StatisticsQuery handler in coordinator/handlers/statistics_v4.go fails to call the sqlvalidator.ValidateRawSQL function, allowing it to pass the user-supplied rawque...

CVE-2026-62251 Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query

Homer is open source telecom observability software. Prior to version 11.0.283, the V4StatisticsQuery handler passes the user-supplied rawquery field directly to DuckDB without calling the sqlvalidator.ValidateRawSQL function used throughout the rest of the codebase. Any authenticated user can...

CVE-2026-62251 Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query

Homer is open source telecom observability software. Prior to version 11.0.283, the V4StatisticsQuery handler passes the user-supplied rawquery field directly to DuckDB without calling the sqlvalidator.ValidateRawSQL function used throughout the rest of the codebase. Any authenticated user can...

CVE-2026-62251 Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query

Homer is open source telecom observability software. Prior to version 11.0.283, the V4StatisticsQuery handler passes the user-supplied rawquery field directly to DuckDB without calling the sqlvalidator.ValidateRawSQL function used throughout the rest of the codebase. Any authenticated user can...

sparx_hack

ثغرات متعددة في Sparx Pro Cloud Server و Enterprise Architect كود استغلال لتنفيذ أوامر SQL عشوائية في خادم Sparx PCS دون مصادقة. ملاحظة: المفتاح غير صحيح لمنع s|rIpt kIddi3 من الاختراق السهل ;- الكتابة الكاملة: https://sploit.tech/2026/05/19/Sparx-Enterprise-Architect-PCS.html الاعتمادات: br0x...

cve-2025-25257

CVE-2025-25257 - प्रयोग वातावरण प्रयोग की वास्तुकला वातावरण FortiWeb के कमजोर घटकों का अनुकरण करता है कमजोर एंडपॉइंट: /api/system/fabric/config इंजेक्शन वेक्टर: HTTP हेडर Authorization: Bearer तंत्र: प्रत्यक्ष SQL संयोजन Python f-string प्रमाणीकरण: कोई नहीं पूर्ण बाईपास डेटाबेस: SQLite प्रदर्शन क...

CVE-2024-26026

CVE-2024-26026 BIG-IP Next Central Manager API बिना प्रमाणीकरण के SQL इंजेक्शन लिंक: https://eclypsium.com/blog/big-vulnerabilities-in-next-gen-big-ip/...

CVE-2023-24203-and-CVE-2023-24204

CVE-2023-24203 और CVE-2023-24204 परिचय साइबर सुरक्षा के निरंतर विकसित होते परिदृश्य में, वेब एप्लिकेशन हमलावरों के लिए एक प्रमुख लक्ष्य बने हुए हैं जो कमजोरियों का शोषण करना चाहते हैं। हाल ही में, SourceCodester Simple Customer Relationship Management CRM System v1.0 में दो महत्वपूर्ण कमजोरियाँ...

GO-2026-6621 SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking in github.com/siyuan-note/siyuan/kernel

SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword publish mode: cross-notebook read/write with statement stacking in github.com/siyuan-note/siyuan/kernel...

CVE-2024-43917

CVE-2024-43917 यह स्क्रिप्ट WordPress के लिए TI WooCommerce Wishlist प्लगइन, संस्करण 2.8.2 तक CVE-2024-43917 में पाए गए SQL इंजेक्शन भेद्यता को प्रदर्शित करती है। यह भेद्यता बिना प्रमाणीकरण के उपयोगकर्ताओं को वेबसाइट के डेटाबेस पर मनमाने SQL कमांड निष्पादित करने की अनुमति देती है, जिससे उपयोगकर्त...

CVE-2024-8275

CVE-2024-8275 CVE-2024-8275 वर्डप्रेस प्लगइन The Events Calendar में पाई गई एक गंभीर SQL इंजेक्शन कमजोरी है। यह कमजोरी संस्करण 6.6.4 तक इसे सम्मिलित करते हुए प्रभावित करती है। समस्या tribehasnextevent फ़ंक्शन में 'order' पैरामीटर के अपर्याप्त एस्केपिंग के कारण उत्पन्न होती है। चूंकि इनपुट को ठीक ...

WordPress Qode Tours plugin <= 3.1.3.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Rafie Muhammad in WordPress Plugin Qode Tours versions = 3.1.3.2...

CVE-2026-42708

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in AF themes WP Post Author wp-post-author allows Blind SQL Injection.This issue affects WP Post Author: from n/a through 4.0.0...

CVE-2026-42710

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in 10Web Slider by 10Web slider-wd allows Blind SQL Injection.This issue affects Slider by 10Web: from n/a through 1.2.63...