Malicious code in @zalastax/nolb-dao (npm)

The package @zalastax/nolb-dao was found to contain malicious code...

Malicious code in arkadiko-dao (npm)

The package arkadiko-dao was found to contain malicious code...

Malicious code in arkadiko-dao-landing (npm)

The package arkadiko-dao-landing was found to contain malicious code...

Malicious code in xrec-base-dao-mongoose (npm)

The package xrec-base-dao-mongoose was found to contain malicious code...

MAL-2025-39989 Malicious code in xrec-base-dao-mongoose (npm)

The package xrec-base-dao-mongoose was found to contain malicious code...

MAL-2025-14831 Malicious code in arkadiko-dao (npm)

The package arkadiko-dao was found to contain malicious code...

MAL-2025-14832 Malicious code in arkadiko-dao-landing (npm)

The package arkadiko-dao-landing was found to contain malicious code...

MAL-2025-11078 Malicious code in @zalastax/nolb-dao (npm)

The package @zalastax/nolb-dao was found to contain malicious code...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the listCount function in the TestDefinitionDAO interface when the testPlatform parameter is used to construct a SQL query. An attacker can extract sensitive information from the database by injecting crafted input int...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the listCount function in the DocStoreDAO interface when the entityType parameter is used to construct a SQL query. An attacker can extract sensitive information from the database by injecting crafted input into the...

CVE-2025-53938

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. An Authentication Bypass vulnerability was identified in the "/dao/verificarrecursoscargo.php" endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows unauthenticat...

CVE-2023-28108

Pimcore is an open source data and experience management platform. Prior to version 10.5.19, quoting is not done properly in UUID DAO model. There is the theoretical possibility to inject custom SQL if the developer is using this methods with input data and not doing proper input validation in...

CVE-2021-32771

Contiki-NG is an open-source, cross-platform operating system for IoT devices. In affected versions it is possible to cause a buffer overflow when copying an IPv6 address prefix in the RPL-Classic implementation in Contiki-NG. In order to trigger the vulnerability, the Contiki-NG system must have...

CVE-2025-3957

A vulnerability was found in opplus springboot-admin 1.0 and classified as critical. This issue affects some unknown processing of the file \src\main\resources\mapper\sys\SysLogDao.xml. The manipulation of the argument order leads to sql injection. The attack may be initiated remotely. The exploi...

spring-boot-admin 注入漏洞

spring-boot-admin is a codecentric open source based on Spring boot Mybatis open source backend management system , with user management , menu management and role management 3 functions , permission control to the button level . spring-boot-admin version 1.0 there are injection vulnerabilities ,...

Timing Attack

Overview org.springframework.security:spring-security-crypto is a spring-security-crypto library for Spring Security. Affected versions of this package are vulnerable to Timing Attack due to an unintentional bypass for DaoAuthenticationProvider constant time controls, which was caused by the fix...

Spring Security BCryptPasswordEncoder maximum password length breaks timing attack mitigation

The fix applied in CVE-2025-22228 inadvertently broke the timing attack mitigation implemented in DaoAuthenticationProvider...

CVE-2025-25590

yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the component /mapper/xml/AddressDao.xml...

CVE-2025-1843: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability, which was classified as critical, has been found in Mini-Tmall up to 20250211. This issue affects the function select of the file com/xq/tmall/dao/ProductMapper.java. The manipulation of the argument orderBy leads to sql injection. The attack may be initiated remotely. The exploi...

CVE-2025-1227

A vulnerability was found in ywoa up to 2024.07.03. It has been rated as critical. This issue affects the function selectList of the file com/cloudweb/oa/mapper/xml/AddressDao.xml. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the...