CVE-2026-17566

CVE-2026-17566 — pgAdmin 4 Import/Export Data RCE PoC PoC de ejecución remota de código en la herramienta Import/Export Data de pgAdmin 4. Aprovecha la divergencia semántica del escape de barra invertida entre el verificador de paréntesis isqueryparensbalanced y psql para inyectar \copy ... TO...

CVE-2026-17543-PHP-Exposure-Validator

PHP CVE-2026-17543 露出検証ツール PHP CVE-2026-17543 への潜在的な露出を確認するための安全なネットワーク側検証ツールです。 このプロジェクトは、リモート Web サーバーが CVE-2026-17543 の影響を受ける PHP バージョンを公開しているかどうかを確認し、オプションで無害な引用符/バックスラッシュ文字を使用して非破壊的なログインフォームプローブを実行できます。 これはエクスプロイトではありません 。 概要 CVE-2026-17543 は、攻撃者が制御するパラメータ内のバックスラッシュのエスケープが不適切な特定の PHP...

CVE-2026-65321-pyathena

CVE-2026-65321: 비-SELECT 문의 백슬래시 따옴표 이스케이프를 통한 PyAthena SQL 인젝션 심각도: Critical, CVSS v4.0 9.3 / CVSS v3.1 9.8 CNA인 VulnCheck이 배정 벡터 v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N 벡터 v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 영향 범위: PyAthena = 3.35.3 3.35.3까지의 모든 버전 수...

CVE-2026-65980 Chartbrew: SQL Injection via Missing Backslash Escaping in ClickHouse Variable Substitution

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, Chartbrew's ClickHouse protocol in server/sources/plugins/clickhouse/clickhouse.protocol.js calls applySqlVariables from...

CVE-2026-65980 Chartbrew: SQL Injection via Missing Backslash Escaping in ClickHouse Variable Substitution

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, Chartbrew's ClickHouse protocol in server/sources/plugins/clickhouse/clickhouse.protocol.js calls applySqlVariables from...

EUVD-2026-69702

Next.js: Unauthenticated Remote Code Execution on windows-hosted servers...

CVE-2026-56127 pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_rules_edit.php

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Rules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewallrulesedit.php. The firewall rule description is stored in the pfSense XML configuration with only backslash-escaping...

php: ext-pgsql: PHP: SQL injection via improper backslash escaping

A flaw was found in PHP. Improper escaping of backslashes in attacker-provided parameters can lead to a SQL injection vulnerability. A remote attacker could exploit this flaw by crafting malicious input, potentially gaining unauthorized access to sensitive information, manipulating data, or causi...

php:7.4 security, bug fix, and enhancement update

An update is available for module.php-pecl-xdebug, module.libzip, php, module.php-pecl-rrd, php-pecl-apcu, module.php-pecl-apcu, libzip, php-pecl-zip, php-pecl-rrd, module.php, php-pecl-xdebug, php-pear, module.php-pear, module.php-pecl-zip. This update affects Rocky Linux 8. A Common Vulnerabili...

RHEL 10 : php (RHSA-2026:62614)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:62614 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext-pgsql: PHP: SQL injection v...

php: ext-pgsql: PHP: SQL injection via improper backslash escaping

A flaw was found in PHP. Improper escaping of backslashes in attacker-provided parameters can lead to a SQL injection vulnerability. A remote attacker could exploit this flaw by crafting malicious input, potentially gaining unauthorized access to sensitive information, manipulating data, or causi...

CVE-2026-75604

Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache Components on Windows-hosted servers do not consistently escape backslashes in route segments before constructing...

CVE-2026-75604

CVE-2026-75604 is a critical (CVSS 9.0) unauthenticated remote code execution vulnerability in Next.js versions 13.4.0 through 15.5.23 and 16.0 through 16.3.2, affecting applications that use Pages Router and App Router without Cache Components on Windows-hosted servers . The root cause is incons...

Security update for python-sqlparse

This update for python-sqlparse fixes the following issues: CVE-2026-54284: TokenList.init materializes Osubtree value per group, causing CPU DoS before depth/token caps trigger bsc1275459. CVE-2026-59893: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS bsc1275461...

php: ext-pgsql: PHP: SQL injection via improper backslash escaping

A flaw was found in PHP. Improper escaping of backslashes in attacker-provided parameters can lead to a SQL injection vulnerability. A remote attacker could exploit this flaw by crafting malicious input, potentially gaining unauthorized access to sensitive information, manipulating data, or causi...

Security update for python-sqlparse

This update for python-sqlparse fixes the following issues: CVE-2026-54284: high algorithm complexity when parsing SQL payloads with hundreds of nesting levels can lead to denial of service via excessive resource consumption bsc1275459. CVE-2026-59893: quadratic complexity when processing unmatch...

SUSE-SU-2026:3906-1 Security update for python3-sqlparse

This update for python3-sqlparse fixes the following issues: - CVE-2026-54284: high algorithm complexity when parsing SQL payloads with hundreds of nesting levels can lead to denial of service via excessive resource consumption bsc1275459. - CVE-2026-59893: quadratic complexity when processing...

ALSA-2026:62334 Important: php:7.4 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archives CVE-2026-7260 Bug Fixes and Enhancements...

php: ext-pgsql: PHP: SQL injection via improper backslash escaping

A flaw was found in PHP. Improper escaping of backslashes in attacker-provided parameters can lead to a SQL injection vulnerability. A remote attacker could exploit this flaw by crafting malicious input, potentially gaining unauthorized access to sensitive information, manipulating data, or causi...

CVE-2026-78691

Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ashsql allows a user who supplies a search term to contains/2, stringstartswith/2, or stringendswith/2 to inject live SQL LIKE wildcards, turning a literal substring search into an attacker-controlled...