📄 CMS Academy Booking 1.0 SQL Injection

CMS Academy Booking version 1.0 suffers from a remote SQL injection vulnerability. ================================================================================================================================== | Title : CMS academy booking v1.0 sql injection vulnerability | | Author : indoush...

CVE-2026-54224: Asymmetric Resource Consumption (Amplification)

UBB.threads is vulnerable to Denial of Service DoS. By sending multiple concurrent requests to view any user profile on instances with many registered users, an authenticated attacker can easily exhaust database resources and completely deny access to the application for other users. Because vend...

PT-2026-50816

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions 1.0 through 9.15 Description An issue exists in the named restore point endpoint 'POST /browser/server/restore point/gid/sid' where the user-supplied value field is interpolated directly into the SQL string using str.format...

AWS VDP: AWS *.a2z.com | Unauthenticated Clickhouse UI : Database access + SSRF

Vulnerability description not provided...

GHSA-99F9-J8R3-P853 Hermes Agent creates response_store.db and webhook_subscriptions.json with world-readable permissions (mode 0o644)

Hermes Agent before 0.16.0 creates responsestore.db and webhooksubscriptions.json with world-readable permissions mode 0o644, exposing conversation history and HMAC secrets to local users. Attackers with local filesystem access can read these files directly to obtain sensitive data including...

CVE-2026-11407

Pimcore CMS/DXP version 12.3.8 contains a sandbox bypass vulnerability that allows authenticated administrative attackers to execute arbitrary methods on PHP objects by exploiting empty checkMethodAllowed and checkPropertyAllowed implementations in the custom Twig SecurityPolicy. Attackers can...

CVE-2026-11407 Pimcore CMS 12.3.8 Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed

Pimcore CMS/DXP version 12.3.8 contains a sandbox bypass vulnerability that allows authenticated administrative attackers to execute arbitrary methods on PHP objects by exploiting empty checkMethodAllowed and checkPropertyAllowed implementations in the custom Twig SecurityPolicy. Attackers can...

CVE-2026-11407

PIMCORE CMS/DXP 12.3.8 contains a sandbox bypass in the Twig SecurityPolicy (checkMethodAllowed and checkPropertyAllowed). Authenticated administrative attackers can craft malicious Twig templates via DataObject ClassDefinition Layout\Text to execute arbitrary PHP object methods, perform file rea...

CVE-2026-11407 Pimcore CMS 12.3.8 Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed

Pimcore CMS/DXP version 12.3.8 contains a sandbox bypass vulnerability that allows authenticated administrative attackers to execute arbitrary methods on PHP objects by exploiting empty checkMethodAllowed and checkPropertyAllowed implementations in the custom Twig SecurityPolicy. Attackers can...

CVE-2026-11407 Pimcore CMS 12.3.8 Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed

Pimcore CMS/DXP version 12.3.8 contains a sandbox bypass vulnerability that allows authenticated administrative attackers to execute arbitrary methods on PHP objects by exploiting empty checkMethodAllowed and checkPropertyAllowed implementations in the custom Twig SecurityPolicy. Attackers can...

CVE-2026-53870

Hermes Agent before 0.16.0 creates responsestore.db and webhooksubscriptions.json with world-readable permissions mode 0o644, exposing conversation history and HMAC secrets to local users. Attackers with local filesystem access can read these files directly to obtain sensitive data including...

com.cheroliv.slider:com.cheroliv.slider.gradle.plugin (>=0.0.1, <=0.0.3), com.cheroliv:slider (>=0.0.1, <=0.0.3) +7 more potentially affected by CVE-2026-55405 via dev.langchain4j:langchain4j-pgvector (>=1.0.0-alpha1, <=1.1.0-beta7)

dev.langchain4j:langchain4j-pgvector MAVEN version =1.0.0-alpha1, =0.0.1, =0.0.1, =8.8.0-alpha4, =0.2.0, =1.1.0.cr1, =1.1.0.cr1, =0.23.0.cr2, =0.23.0.cr2, =1.0.0, =1.0.1 Source cves: CVE-2026-55405 Source advisory: OSV:GHSA-2MFG-CC43-9PCJ...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the EmbeddingSearchRequest.filter process. An attacker can access sensitive data, modify or delete database records, or cause denial of service by injecting crafted input into metadata filter keys or values, which are...

EUVD-2025-210250

Unauthenticated SQL Injection in Advanced Ads – Tracking 3.0.7 versions...

EUVD-2026-37630

Subscriber SQL Injection in Cornerstone 7.8.8 versions...

EUVD-2026-37612

Subscriber SQL Injection in Geo Mashup = 1.13.19 versions...

EUVD-2026-37621

Unauthenticated SQL Injection in JetEngine 3.8.9.1 versions...

EUVD-2026-37611

Unauthenticated SQL Injection in JetSmartFilters = 3.8.1 versions...

EUVD-2026-37573

In Contacts Provider, there is a possible way to access the contacts database due to SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-37380

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM component: Database Upgrade. Supported versions that are affected are 17.0-26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to...