94541 matches found
CVE-2019-25765
creationtimestamp| type| source ---|---|--- 2026-08-13 18:46:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/eio7hnpnmjbon 2026-08-14 14:00:30+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/b6890fd9-837f-4a64-a1fa-c036ecba0806 2026-08-30...
CVE-2026-73651 TypeORM: migration:generate template-literal code injection
TypeORM is a TypeScript and JavaScript ORM for Node.js that supports PostgreSQL, MySQL, MariaDB, SQLite, SQL Server, Oracle, and other databases. Prior to versions 0.3.31 and 1.1.0, typeorm migration:generate embeds database schema metadata into JavaScript or TypeScript template literals in...
GHSA-48P8-G2FX-3WWM
creationtimestamp| type| source ---|---|--- 2026-08-13 17:32:46+00:00| seen| https://gist.github.com/alon710/ee760ed8dd4e3944f68b62f514473cdc...
CVE-2019-25765
ASP-CMS contains a SQL injection vulnerability in the commentList.asp endpoint that allows unauthenticated remote attackers to inject arbitrary SQL by manipulating the id parameter in GET requests to the comment listing script. Attackers can bypass the application's keyword blocklist by...
CVE-2026-71287
A flaw was found in Cacti. An authenticated user, regardless of their privilege level, can exploit a vulnerability where user-supplied input for sorting database columns is not properly sanitized. This allows for the injection of malicious SQL commands, leading to time-based blind SQL injection...
Unsafe Dependency Resolution
Overview Affected versions of this package are vulnerable to Unsafe Dependency Resolution via the \unrestrict meta-command input expansion in the restore process. An attacker can execute arbitrary code as the client operating system account by injecting malicious input from a compromised origin...
CVE-2026-73514 PostGIS address_standardizer Out-of-Bounds Write via standardize_address()
The addressstandardizer extension for PostGIS through 3.7.0, fixed in commit 423570b, contains an out-of-bounds write vulnerability that allows a database user with the ability to supply caller-controlled relation names to standardizeaddress to trigger memory corruption by providing a rules table...
CVE-2026-66430
Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.10 versions...
CVE-2026-28189
Unauthenticated Arbitrary File Deletion in Participants Database = 2.7.8.4 versions...
SQL Injection
Overview pimcore/pimcore is a content & product management framework CMS/PIM/E-Commerce. Affected versions of this package are vulnerable to SQL Injection via improper validation of class definition UIDs and unquoted concatenation of class IDs in SQL queries. An attacker can access sensitive...
CVE-2026-66658
Subscriber SQL Injection in Reviewer = 3.14.2 versions...
CVE-2026-66658
CVE-2026-66658 affects WordPress Reviewer plugin versions ≤ 3.14.2. The issue is described as a SQL Injection vulnerability (Subscriber SQL Injection) with CVSS 3.1, base score 8.5 (HIGH), vector: NETWORK/attackVector N, AC:L, PR:L, UI:N, S:C, C:H, I:N, A:L. Connected sources include CVE records ...
CVE-2026-66478
Unauthenticated SQL Injection in Church Admin = 5.1.1 versions...
CVE-2026-66430
CVE-2026-66430 describes an SQL Injection in the WordPress plugin Visitor Traffic Real Time Statistics Pro (versions
CVE-2026-28189 WordPress Participants Database plugin <= 2.7.8.4 - Arbitrary File Deletion vulnerability
Unauthenticated Arbitrary File Deletion in Participants Database = 2.7.8.4 versions...
CVE-2026-28189
The CVE-2026-28189 entry concerns the WordPress Participants Database plugin version <= 2.7.8.4, which is affected by an unauthenticated Arbitrary File Deletion vulnerability. The available records indicate the issue arises in this plugin series and can be triggered without authentication, wit...
CVE-2026-28189
Unauthenticated Arbitrary File Deletion in Participants Database = 2.7.8.4 versions...
EUVD-2026-57967
Unauthenticated Arbitrary File Deletion in Participants Database = 2.7.8.4 versions...