236429 matches found
SQL Injection
Overview langroid is a Harness LLMs with Multi-Agent Programming Affected versions of this package are vulnerable to SQL Injection via insufficient filtering in the validatequery process. An attacker can access arbitrary files on the database host and perform filesystem reconnaissance by injectin...
GHSA-PMCH-G965-GRMR Langroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file read
Summary SQLChatAgent in langroid ships a validatequery defense-in-depth layer whose DANGEROUSSQLPATTERNS regex blocklist enumerates dangerous SQL primitives by specific function name. The list misses the canonical PostgreSQL filesystem-disclosure family pgreadfile, pgstatfile, pglslogdir,...
CVE-2026-54404
A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found in UniFi OS to escalate privileges within such UniFi OS devices or instances...
CVE-2026-56841
CVE-2026-56841 describes an authenticated SQL Injection vulnerability in UniFi Protect Application. A network-accessible attacker with low privileges can exploit this to escalate privileges on the host device. Affected software: UniFi Protect Application (specific versions not stated in the provi...
CVE-2026-54404
UniFi OS is affected by CVE-2026-54404, which describes a series of authenticated SQL Injection vulnerabilities that allow a user with network access and low privileges to escalate privileges within UniFi OS devices or instances. The available sources confirm the issue and provide a CVSSv3.1 base...
CVE-2026-54404
A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found in UniFi OS to escalate privileges within such UniFi OS devices or instances...
PYSEC-2026-640 SQL Injection in FreeTAKServer-UI
FreeTAKServer-UI v1.9.8 was discovered to contain a SQL injection vulnerability via the API endpoint /AuthenticateUser...
WordPress CWS SVGicons plugin <= 1.5.5 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Phat RiO in WordPress Plugin CWS SVGicons versions = 1.5.5...
WordPress Advanced Shipment Tracking for WooCommerce plugin <= 4.0 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Nguyen Ba Khanh in WordPress Plugin Advanced Shipment Tracking for WooCommerce versions = 4.0...
CVE-2026-57765
Contributor SQL Injection in WP EasyCart = 5.9.0 versions...
CVE-2026-57752
Contributor SQL Injection in iNET Webkit 1.2.4 versions...
CVE-2026-57683
Unauthenticated SQL Injection in WP Fast Total Search = 1.80.280 versions...
CVE-2026-57687
Contributor SQL Injection in Custom Field Template = 2.7.8 versions...
CVE-2026-57679
Unauthenticated SQL Injection in GeekyBot = 1.2.5 versions...
CVE-2025-69094
Subscriber SQL Injection in Unicamp = 2.2.2 versions...
WordPress WP Inventory Manager plugin <= 2.4.0 - SQL Injection vulnerability
SQL Injection vulnerability discovered by dodoh4t in WordPress Plugin WP Inventory Manager versions = 2.4.0...
CVE-2026-57765
Contributor SQL Injection in WP EasyCart = 5.9.0 versions...
CVE-2026-57765
WP EasyCart WordPress plugin versions
