PYSEC-2026-3922 SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`

Summary ModelView.sortquery uses the attacker-controlled sortBy list-view query parameter without checking it against the configured columnsortablelist allow-list. The value is resolved with getattrmodel, ... and fed into relationship joins and orderby, so a request can sort by any column of the...

EUVD-2026-75218

Authentication Bypass via Hardcoded Master Verification Code vulnerability in Siam Ordering siam-server 1.0.0 allows remote unauthenticated attackers to log in as any user, merchant, or administrator...

CVE-2026-71809

Authentication Bypass via Hardcoded Master Verification Code vulnerability in Siam Ordering siam-server 1.0.0 allows remote unauthenticated attackers to log in as any user, merchant, or administrator...

CVE-2026-71808

A SQL Injection vulnerability in Siam Ordering siam-server 1.0.0 allows remote authenticated attackers to execute arbitrary SQL commands via the $ string concatenation in AdminMapper.java and multiple other Mapper files including MerchantWithdrawRecordMapper.java and MemberWithdrawRecordMapper.ja...

SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`

Summary ModelView.sortquery uses the attacker-controlled sortBy list-view query parameter without checking it against the configured columnsortablelist allow-list. The value is resolved with getattrmodel, ... and fed into relationship joins and orderby, so a request can sort by any column of the...

GHSA-CCG5-9C8W-XH6V SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`

Summary ModelView.sortquery uses the attacker-controlled sortBy list-view query parameter without checking it against the configured columnsortablelist allow-list. The value is resolved with getattrmodel, ... and fed into relationship joins and orderby, so a request can sort by any column of the...

CVE-2026-71808

A SQL Injection vulnerability in Siam Ordering siam-server 1.0.0 allows remote authenticated attackers to execute arbitrary SQL commands via the $ string concatenation in AdminMapper.java and multiple other Mapper files including MerchantWithdrawRecordMapper.java and MemberWithdrawRecordMapper.ja...

CVE-2026-71808

A SQL Injection vulnerability exists in Siam Ordering (siam-server) 1.0.0 . The flaw is caused by the use of ${} string concatenation within AdminMapper.java and several other Mapper files, such as MerchantWithdrawRecordMapper.java and MemberWithdrawRecordMapper.java . This allows remote authenti...

EUVD-2026-75159

A SQL Injection vulnerability in Siam Ordering siam-server 1.0.0 allows remote authenticated attackers to execute arbitrary SQL commands via the $ string concatenation in AdminMapper.java and multiple other Mapper files including MerchantWithdrawRecordMapper.java and MemberWithdrawRecordMapper.ja...

CVE-2026-71809

Authentication Bypass via Hardcoded Master Verification Code vulnerability in Siam Ordering siam-server 1.0.0 allows remote unauthenticated attackers to log in as any user, merchant, or administrator...

CVE-2026-71809

Siam Ordering (siam-server ) version 1.0.0 is vulnerable to an Authentication Bypass caused by a hardcoded master verification code . This security flaw allows remote unauthenticated attackers to gain unauthorized access to the system, enabling them to log in as any user, merchant, or administrat...

PT-2026-89181

Authentication Bypass via Hardcoded Master Verification Code vulnerability in Siam Ordering siam-server 1.0.0 allows remote unauthenticated attackers to log in as any user, merchant, or administrator...

PT-2026-89153

A SQL Injection vulnerability in Siam Ordering siam-server 1.0.0 allows remote authenticated attackers to execute arbitrary SQL commands via the $ string concatenation in AdminMapper.java and multiple other Mapper files including MerchantWithdrawRecordMapper.java and MemberWithdrawRecordMapper.ja...

CVE-2026-71808

A SQL Injection vulnerability in Siam Ordering siam-server 1.0.0 allows remote authenticated attackers to execute arbitrary SQL commands via the $ string concatenation in AdminMapper.java and multiple other Mapper files including MerchantWithdrawRecordMapper.java and MemberWithdrawRecordMapper.ja...

CVE-2026-71809

Authentication Bypass via Hardcoded Master Verification Code vulnerability in Siam Ordering siam-server 1.0.0 allows remote unauthenticated attackers to log in as any user, merchant, or administrator...

CVE-2026-71809: Use of Hard-coded Password

Authentication Bypass via Hardcoded Master Verification Code vulnerability in Siam Ordering siam-server 1.0.0 allows remote unauthenticated attackers to log in as any user, merchant, or administrator...

CVE-2026-71808: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection vulnerability in Siam Ordering siam-server 1.0.0 allows remote authenticated attackers to execute arbitrary SQL commands via the $ string concatenation in AdminMapper.java and multiple other Mapper files including MerchantWithdrawRecordMapper.java and MemberWithdrawRecordMapper.ja...

PT-2026-89205

Summary ModelView.sort query uses the attacker-controlled sortBy list-view query parameter without checking it against the configured column sortable list allow-list. The value is resolved with getattrmodel, ... and fed into relationship joins and order by, so a request can sort by any column of...

SUSE CVE-2026-80906

In the Linux kernel, the following vulnerability has been resolved: net: packet: fix wrong transportheader when sending VLAN-tagged frame In packetparseheaders, when processing a VLAN-tagged frame, skbsetnetworkheader is called to advance networkheader past the VLAN tag to the inner protocol...

Linux Distros Unpatched Vulnerability : CVE-2026-80895

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mshv: Order ptvparray publish against irqfd assertion path mshvpartitionioctlcreatevp initialises a VP struct allocations, mutexinit, initwaitqueuehead, page...