CVE-2026-63713 Toptech TMS7 and TopHAT SQL Injection

The "search" parameter in the view audit logs feature within the utilities section is susceptible to a time-based blind SQL injection vulnerability...

AZL-105051 CVE-2026-102253 affecting package iperf3 3.17.1-6

iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive worker into an unrecoverable infinite loop by sending a single crafted control-channel parameter message followed by one 16-byte UDP datagra...

DEBIAN-CVE-2026-102253

iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive worker into an unrecoverable infinite loop by sending a single crafted control-channel parameter message followed by one 16-byte UDP datagra...

CVE-2026-102253

iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive worker into an unrecoverable infinite loop by sending a single crafted control-channel parameter message followed by one 16-byte UDP datagra...

UBUNTU-CVE-2026-102253

iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive worker into an unrecoverable infinite loop by sending a single crafted control-channel parameter message followed by one 16-byte UDP datagra...

CVE-2026-102253 iperf3 < 3.22 UDP Receive Worker Infinite Loop DoS

iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive worker into an unrecoverable infinite loop by sending a single crafted control-channel parameter message followed by one 16-byte UDP datagra...

CVE-2026-102253 iperf3 < 3.22 UDP Receive Worker Infinite Loop DoS

iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive worker into an unrecoverable infinite loop by sending a single crafted control-channel parameter message followed by one 16-byte UDP datagra...

CVE-2026-102253

Versions of iperf3 prior to 3.22 are vulnerable to a denial of service (DoS) vulnerability. An unauthenticated remote attacker can trigger an unrecoverable infinite loop in the server's UDP receive worker by sending a single crafted control-channel parameter message followed by one 16-byte UDP da...

CVE-2026-102253 iperf3 < 3.22 UDP Receive Worker Infinite Loop DoS

iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive worker into an unrecoverable infinite loop by sending a single crafted control-channel parameter message followed by one 16-byte UDP datagra...

EUVD-2026-89415

iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive worker into an unrecoverable infinite loop by sending a single crafted control-channel parameter message followed by one 16-byte UDP datagra...

CVE-2023-54400

Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary SQL through the Name parameter of the getEmpByname action without any authentication. Attackers can exploit UNION-based SQL injection...

EUVD-2022-56062

Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell command execution. Authenticated users with admin panel access can inject shell metacharacters into the alias parameter to...

CVE-2022-51019 Akaunting before 2.1.31 OS Command Injection via app alias

Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell command execution. Authenticated users with admin panel access can inject shell metacharacters into the alias parameter to...

CVE-2022-51019

Akaunting versions prior to 2.1.31 are vulnerable to an OS command injection vulnerability within the module installation and update flow. The root cause is the unvalidated passing of the alias parameter to shell command execution. Authenticated users with admin panel access can exploit this by i...

CVE-2022-51019 Akaunting before 2.1.31 OS Command Injection via app alias

Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell command execution. Authenticated users with admin panel access can inject shell metacharacters into the alias parameter to...

CVE-2023-54400 Fumeng Cloud SQL Injection via AjaxMethod.ashx getEmpByname

Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary SQL through the Name parameter of the getEmpByname action without any authentication. Attackers can exploit UNION-based SQL injection...

EUVD-2023-60696

Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary SQL through the Name parameter of the getEmpByname action without any authentication. Attackers can exploit UNION-based SQL injection...

CVE-2023-54400

Fumasoft Fumeng Cloud is vulnerable to a SQL injection flaw in the AjaxMethod.ashx endpoint. Specifically, the getEmpByname action fails to properly sanitize the Name parameter, allowing unauthenticated remote attackers to execute arbitrary SQL commands against the Microsoft SQL Server backend. E...

intigriti-0926-writeup

Intigriti Challenge 0926 — Critter Gallery: UNION-based SQL In...

CVE-2026-96430

Exposed Dangerous Method or Function in the /WebAgenda/SQLWin.do API endpoint of Flowring Agentflow 4.0 version Before 2026/08/28 allows remote authenticated users to execute arbitrary SQL commands via the sql parameter...