CVE-2026-107375

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request paramete...

GHSA-R223-96JV-Q533 JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort

SQL Injection in the sort Parameter of JHipster-Generated Reactive WebFlux + R2DBC Applications - Product: jhipster/generator-jhipster npm package generator-jhipster - Affected versions: v7.0.0 through v9.2.0 - Component: generated reactive-application code, template EntityManagerreactive.java.ej...

NPM: JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort

NPM: JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive WebFlux + R2DBC Applicationssort vulnerability discovered by ? in WordPress Npm generator-jhipster versions = 7.0.0, 9.4.0...

JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort

SQL Injection in the sort Parameter of JHipster-Generated Reactive WebFlux + R2DBC Applications - Product: jhipster/generator-jhipster npm package generator-jhipster - Affected versions: v7.0.0 through v9.2.0 - Component: generated reactive-application code, template EntityManagerreactive.java.ej...

CVE-2026-107375 JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request paramete...

EUVD-2026-95130

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request paramete...

CVE-2026-107375 JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request paramete...

CVE-2026-107375 JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request paramete...

CVE-2026-107375

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request paramete...

CVE-2026-107375

Applications generated using JHipster (versions 7.0.0 through 9.4.0) are vulnerable to SQL Injection when using Spring WebFlux , Spring Data R2DBC , and a SQL database. The vulnerability exists because the sort request parameter from paginated entity-list endpoints is passed into the createOrderB...

GHSA-WF65-4JJX-Q444 PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL

PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL Summary The PGVector and Cassandra knowledge-store backends validate SQL/CQL identifiers such as schema, keyspace, and collection names, but still insert the caller-controlled dimension argument directly into CREATE...

PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL

PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL Summary The PGVector and Cassandra knowledge-store backends validate SQL/CQL identifiers such as schema, keyspace, and collection names, but still insert the caller-controlled dimension argument directly into CREATE...

WordPress Tickera plugin <= 3.6.0.6 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Rasyid Abdi Gantoro in WordPress Plugin Tickera versions = 3.6.0.6...

WebAttackDetector

WebAttackDetector Static machine-learning triage for suspicio...

ProcessMaker SQL Injection Vulnerability

Versions of ProcessMaker prior to 2026.14.3 have a SQL injection vulnerability. This vulnerability stems from the unvalidated orderby parameter in the GET /api/1.0/tasks endpoint. The orderby parameter is bound to user-controlled processrequests column names, which are used in the DB::raw SQL...

Security Bulletin: Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection

Summary Multiple vulnerabilities have been addressed in the Sniffer component as part of IBM Guardium Data Protection Vulnerability Details CVEID:CVE-2026-75875 DESCRIPTION: IBM Guardium Data Protection could allow a remote attacker to execute arbitrary code due to path traversal. CWE:CWE-22:...

sxwp2shell

/ / / / / / | |/ / \ / / / / / / / / | / / / / / / / // / / / / / // | //// ///// /////|| sxwp2shell — Pre-auth RCE exploit for WordPress via REST API batch-route confusion CVE-2026-63030 + SQL injection CVE-2026-60137. Affected: WP 6.9.0–6.9.4 / 7.0.0–7.0.1 Install git clone...

EUVD-2026-95035

mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the runQueryButton postback and exportSqlQueryServer PageMethod execute caller-supplied SQL against the backing Sybase SQL Anywhere database using DBA/sysadmin...

Exploit for Authentication Bypass Using an Alternate Path or Channel in Sangoma Freepbx

freepbx-rce-detector Triage scanner for CVE-2025-57819, t...

CVE-2026-105076

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Appsbd Vitepos vitepos-lite allows Blind SQL Injection.This issue affects Vitepos: from n/a through 3.6.1...