242 matches found
CVE-2026-35395 WeGIA has a SQL Injection in DespachoDAO.php via id_memorando parameter
WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, WeGIA Web gerenciador para instituições assistenciais contains a SQL injection vulnerability in dao/memorando/DespachoDAO.php. The idmemorando parameter is extracted from $REQUEST without validation and directly interpolated into...
EUVD-2026-19495
WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, WeGIA Web gerenciador para instituições assistenciais contains a SQL injection vulnerability in dao/memorando/DespachoDAO.php. The idmemorando parameter is extracted from $REQUEST without validation and directly interpolated into...
CVE-2026-35395: Improper Neutralization of Special Elements used in an SQL Command
WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, WeGIA Web gerenciador para instituições assistenciais contains a SQL injection vulnerability in dao/memorando/DespachoDAO.php. The idmemorando parameter is extracted from $REQUEST without validation and directly interpolated into...
CVE-2026-5328
CVE-2026-5328 affects shsuishang modulithshop, specifically the ProductItemDao/ProductIndexServiceImpl.java listItem function. The vulnerability arises from manipulating the sidx/sort parameter, enabling SQL injection via remote input. A patch identified as 42bcb9463425d1be906c3b290cf29885eb5a232...
GHSA-VXG3-V4P6-F3FP Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause
The filter query parameter in the dependency listing endpoints is JSON-decoded and the value field is concatenated directly into RLIKE clauses without sanitization or parameterized queries. Affected code in models/Dependency/Dao.php: - getFilterRequiresByPath lines 90, 95, 100 -...
CVE-2025-22234
The fix applied in CVE-2025-22228 inadvertently broke the timing attack mitigation implemented in DaoAuthenticationProvider. This can allow attackers to infer valid usernames or other authentication behavior via response-time differences under certain configurations. Mitigation Mitigation for thi...
Spring Security has a broken timing attack mitigation implemented in DaoAuthenticationProvide
The fix applied in CVE-2025-22228 inadvertently broke the timing attack mitigation implemented in DaoAuthenticationProvider. This can allow attackers to infer valid usernames or other authentication behavior via response-time differences under certain configurations...
CVE-2025-22234 Spring Security - BCrypt Password Encoder maximum password length breaks timing attack mitigation
The fix applied in CVE-2025-22228 inadvertently broke the timing attack mitigation implemented in DaoAuthenticationProvider. This can allow attackers to infer valid usernames or other authentication behavior via response-time differences under certain configurations...
EUVD-2026-3787
The fix applied in CVE-2025-22228 inadvertently broke the timing attack mitigation implemented in DaoAuthenticationProvider. This can allow attackers to infer valid usernames or other authentication behavior via response-time differences under certain configurations...
CVE-2025-22234 Spring Security - BCrypt Password Encoder maximum password length breaks timing attack mitigation
The fix applied in CVE-2025-22228 inadvertently broke the timing attack mitigation implemented in DaoAuthenticationProvider. This can allow attackers to infer valid usernames or other authentication behavior via response-time differences under certain configurations...
EUVD-2025-198333
HackerOne community member Dao Hoang Anh yoyomiski has reported an uncontrolled resource consumption vulnerability in the “userlog-index.php”. An attacker with access to the admin interface could request an arbitrarily large number of items per page, potentially leading to a denial of service...
CVE-2025-55128
HackerOne community member Dang Hung Vi vidang04 has reported an uncontrolled resource consumption vulnerability in the “userlog-index.php”. An attacker with access to the admin interface could request an arbitrarily large number of items per page, potentially leading to a denial of service...
Malicious code in arts-dao (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f6dc0a6f4a2673aff819afc3034818eccb2669fad02cac2ebc2ab84ccc3431e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-79787
Malicious code in arts-dao npm...
absolute_woodpecker_dumbs (1.2.1), academic_eel_dumbs (3.3.1) +2428 more potentially affected by unknown CVE via arts-dao (1.1.5)
arts-dao NPM version 1.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on arts-dao and may be impacted: - absolutewoodpeckerdumbs 1.2.1 - academiceeldumbs 3.3.1 - academicmolluskdumbs 1.4.1 - acceptablefishdumbs 2.4.4 - acceptablemoledumbs 1.3.3 -...
EUVD-2021-19535
Malware in sbrugna...
EUVD-2018-2775
Malware in sbrugna...
EUVD-2025-25388
Malicious code in bioql PyPI...