262084 matches found
CVE-2026-110609
Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword parameter in the queryErpOrderItem MyBatis statement using raw $ substitution. Attackers can send crafted keyword values to the...
CVE-2026-89076 MOVEit Transfer SQL injection in custom reporting
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Progress MOVEit Transfer Custom Reports module. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...
EUVD-2026-101158
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Progress MOVEit Transfer Custom Reports module. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...
CVE-2026-89076
Progress MOVEit Transfer is impacted by an SQL injection vulnerability (CWE-89) within the Custom Reports module . The flaw stems from the improper neutralization of special elements used in SQL commands. This issue affects versions before 2025.1.6 and versions from 2026.0.0 before 2026.0.4 . The...
CVE-2026-94348
Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service...
CVE-2026-108065
SQL Injection CWE-89 in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce VERSION — missing allows an unauthenticated remote attacker to read, write, and potentially execute commands on the backend Microsoft SQL Server via a crafted sUserID...
[SECURITY] [DSA 6561-1] sogo security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6561-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 14, 2026 https://www.debian.org/security/faq -...
EUVD-2026-101242
Yiuman citrus through 0.15.0 contains an ORDER BY sql injection vulnerability in the citrus-support generic query framework that allows users to inject SQL via the sortBy request parameter. Attackers can reach any generic list route of controllers extending BaseQueryController or BaseQueryRestful...
CVE-2026-110614
The Yiuman citrus framework (versions through 0.15.0 ) is vulnerable to an ORDER BY SQL Injection within the citrus-support generic query framework. The root cause is the failure to validate the sortBy request parameter, allowing attackers to append unvalidated SQL to the ORDER BY clause. This vu...
CVE-2026-110614 Yiuman citrus through 0.15.0 ORDER BY SQL Injection via sortBy Parameter
Yiuman citrus through 0.15.0 contains an ORDER BY sql injection vulnerability in the citrus-support generic query framework that allows users to inject SQL via the sortBy request parameter. Attackers can reach any generic list route of controllers extending BaseQueryController or BaseQueryRestful...
CVE-2026-110614 Yiuman citrus through 0.15.0 ORDER BY SQL Injection via sortBy Parameter
Yiuman citrus through 0.15.0 contains an ORDER BY sql injection vulnerability in the citrus-support generic query framework that allows users to inject SQL via the sortBy request parameter. Attackers can reach any generic list route of controllers extending BaseQueryController or BaseQueryRestful...
CVE-2026-110609 Dromara Skyeye through commit 65d3ddcede70 SQL Injection via keyword Parameter
Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword parameter in the queryErpOrderItem MyBatis statement using raw $ substitution. Attackers can send crafted keyword values to the...
CVE-2026-110609
The Dromara Skyeye application (through commit 65d3ddcede70) is vulnerable to SQL Injection via the keyword parameter in the queryErpOrderItem MyBatis statement. The root cause is the use of raw ${} substitution instead of prepared statements. Authenticated low-privileged users can send crafted k...
EUVD-2026-101237
Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword parameter in the queryErpOrderItem MyBatis statement using raw $ substitution. Attackers can send crafted keyword values to the...
CVE-2026-110609 Dromara Skyeye through commit 65d3ddcede70 SQL Injection via keyword Parameter
Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword parameter in the queryErpOrderItem MyBatis statement using raw $ substitution. Attackers can send crafted keyword values to the...
EUVD-2026-101030
Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service...
CVE-2026-94348
Dell PowerScale InsightIQ versions 5.2.0 through 6.3.0 are susceptible to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. A low privileged attacker with local access could exploit this flaw to cause a Denial of Service . No specific exploi...
CVE-2026-94348
Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service...
CVE-2026-108065 Unauthenticated SQL Injection in Channel Software WebAlliance eCommerce
SQL Injection CWE-89 in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce VERSION — missing allows an unauthenticated remote attacker to read, write, and potentially execute commands on the backend Microsoft SQL Server via a crafted sUserID...
CVE-2026-108065
Channel Software WebAlliance eCommerce is vulnerable to an unauthenticated SQL Injection (CWE-89) within the SOAP GetUser method of the /preapproval.asmx endpoint. An attacker can exploit this by providing a crafted sUserID parameter containing a single quote and a stacked SQL query. This vulnera...