CVE-2026-32767

SiYuan is a personal knowledge management system. Versions 3.6.0 and below contain an authorization bypass vulnerability in the /api/search/fullTextSearchBlock endpoint. When the method parameter is set to 2, the endpoint passes user-supplied input directly as a raw SQL statement to the underlyin...

CVE-2026-32767: Improper Neutralization of Special Elements used in an SQL Command

SiYuan is a personal knowledge management system. Versions 3.6.0 and below contain an authorization bypass vulnerability in the /api/search/fullTextSearchBlock endpoint. When the method parameter is set to 2, the endpoint passes user-supplied input directly as a raw SQL statement to the underlyin...

EUVD-2005-3864

Malware in sbrugna...

EUVD-2018-8203

Malware in sbrugna...

CVE-2025-10210

A weakness has been identified in yanyutao0402 ChanCMS up to 3.3.0. Impacted is the function Search of the file app/modules/api/service/Api.js. Executing manipulation of the argument key can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the...

CVE-2011-10026

Spreecommerce versions prior to 0.50.x contain a remote command execution vulnerability in the API's search functionality. Improper input sanitation allows attackers to inject arbitrary shell commands via the searchinstanceeval parameter, which is dynamically invoked using Ruby’s send method. Thi...

Spree Commerce 安全漏洞

Spree Commerce is an e-commerce platform from Spree Open Source. A security vulnerability exists in Spree Commerce versions prior to 0.50.x. The vulnerability stems from improper input cleanup in the API search function and could lead to remote command execution...

Malicious code in ares-api-search (npm)

The package ares-api-search was found to contain malicious code...

MAL-2025-14817 Malicious code in ares-api-search (npm)

The package ares-api-search was found to contain malicious code...

CVE-2025-54868

LibreChat is a ChatGPT clone with additional features. In versions 0.0.6 through 0.7.7-rc1, an exposed testing endpoint allows reading arbitrary chats directly from the Meilisearch engine. The endpoint /api/search/test allows for direct access to stored chats in the Meilisearch engine without...

CVE-2025-54868: Improper Authorization

LibreChat is a ChatGPT clone with additional features. In versions 0.0.6 through 0.7.7-rc1, an exposed testing endpoint allows reading arbitrary chats directly from the Meilisearch engine. The endpoint /api/search/test allows for direct access to stored chats in the Meilisearch engine without...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the search bar process when page descriptions are inserted into raw HTML without proper sanitization. An attacker can execute arbitrary JavaScript in the context of another user by injecting malicious conten...

Shopware 安全漏洞

Shopware is a suite of open source e-commerce software from the German company Shopware. A security vulnerability exists in Shopware versions prior to 6.5.8.13, which originates from a SQL injection in the /api/search/order endpoint...

CVE-2025-27892: Improper Neutralization of Special Elements used in an SQL Command

Shopware prior to version 6.5.8.13 is affected by a SQL injection vulnerability in the /api/search/order endpoint. NOTE: this issue exists because of a CVE-2024-22406 and CVE-2024-42357 regression...

CVE-2025-27892

Shopware prior to version 6.5.8.13 is affected by a SQL injection vulnerability in the /api/search/order endpoint. NOTE: this issue exists because of a CVE-2024-22406 and CVE-2024-42357 regression...

CVE-2023-30347

Cross Site Scripting XSS vulnerability in Neox Contact Center 2.3.9, via the serachsmsapiname parameter to the SMA API search...

CVE-2023-30347: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability in Neox Contact Center 2.3.9, via the serachsmsapiname parameter to the SMA API search...

PT-2023-22644

Name of the Vulnerable Software and Affected Versions Neox Contact Center version 2.3.9 Description A Cross Site Scripting XSS issue exists, allowing exploitation via the serach sms api name parameter to the SMA API search. Recommendations For Neox Contact Center version 2.3.9, avoid using the...

PT-2022-18649

Name of the Vulnerable Software and Affected Versions E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin versions = 1.5.3 Description The issue allows attackers to obtain booking data by guessing or brute-forcing easily predictable booking IDs via search POST requests to API endpoints such a...

CVE-2021-39122

Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view users' emails via an Information Disclosure vulnerability in the /rest/api/2/search endpoint. The affected versions are before version 8.5.13, from version 8.6.0 before 8.13.5, and from version...