SQL Injection

Overview llama-index-vector-stores-duckdb is a llama-index vectorstores duckdb integration Affected versions of this package are vulnerable to SQL Injection through the DuckDBVectorStore class. An attacker can manipulate the refdocid parameter, enabling them to read and write arbitrary files on t...

LlamaIndex SQL注入漏洞

LlamaIndex is a data framework for LLM applications from LlamaIndex open source. A SQL injection vulnerability exists in LlamaIndex version v0.12.19, which stems from improper manipulation of the refdocid parameter leading to SQL injection, which could lead to remote code execution...

CVE-2024-32468

Deno is a runtime for JavaScript and TypeScript written in rust. Several cross-site scripting vulnerabilities existed in the denodoc crate which lead to Self-XSS with deno doc --html. 1. XSS in generated searchindex.js, denodoc outputs a JavaScript file for searching. However, the generated file...

CVE-2024-0216

The Google Doc Embedder plugin for WordPress is vulnerable to Server Side Request Forgery via the 'gview' shortcode in versions up to, and including, 2.6.4. This can allow authenticated attackers with contributor-level permissions or above to make web requests to arbitrary locations originating...

CVE-2022-1731

Metasonic Doc WebClient 7.0.14.0 / 7.0.12.0 / 7.0.3.0 is vulnerable to a SQL injection attack in the username field. SSO or System authentication are required to be enabled for vulnerable conditions to exist...

CVE-2021-35414

Chamilo LMS v1.11.x was discovered to contain a SQL injection via the doc parameter in main/plagiarism/compilatio/upload.php...

CVE-2021-21259

HedgeDoc is open source software which lets you create real-time collaborative markdown notes. In HedgeDoc before version 1.7.2, an attacker can inject arbitrary JavaScript into a HedgeDoc note, which is executed when the note is viewed in slide mode. Depending on the configuration of the instanc...

CVE-2015-1879

Cross-site scripting XSS vulnerability in the Google Doc Embedder plugin before 2.5.19 for WordPress allows remote attackers to inject arbitrary web script or HTML via the profile parameter in an edit action in the gde-settings page to wp-admin/options-general.php...

Malicious code in api-doc-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4ed9c9d80a7285c6d9eab363f722cabd59b29f3239576a4562e6c881d6ad8899 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

OESA-2025-1401 ghostscript security update

Ghostscript is an interpreter for PostScript™ and Portable Document Format PDF files. Ghostscript consists of a PostScript interpreter layer, and a graphics library. Security Fixes: An issue was discovered in Artifex Ghostscript before 10.05.0. The DOCXWRITE TXTWRITE device has a text buffer...

DEBIAN-CVE-2025-27831

An issue was discovered in Artifex Ghostscript before 10.05.0. The DOCXWRITE TXTWRITE device has a text buffer overflow via long characters to devices/vector/doccommon.c...

CVE-2024-10833

CVE-2024-10833 affects eosphoros-ai/db-gpt v0.6.0. The vulnerability is an absolute path traversal in the knowledge API’s file upload endpoint (knowledge/{space_name}/document/upload), where the user-controllable parameter doc_file.filename enables arbitrary file writes to locations on the target...

PT-2025-12070

Name of the Vulnerable Software and Affected Versions eosphoros-ai/db-gpt version 0.6.0 Description The issue arises because the file key and doc file.filename parameters are user-controllable, enabling the construction of paths outside the intended directory. This can lead to overwriting essenti...

DRUPAL-CONTRIB-2025-025

This module can be used to render Open API Documentation using the RapiDoc library. The module provides a custom formatter for link fields. Drupal core does not sufficiently sanitize link element attributes, which can lead to a Cross Site Scripting vulnerability XSS. A separate fix for Drupal cor...

Adobe Acrobat Reader DC Doc Object Out-Of-Bounds Read Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handli...

PwnDoc 路径遍历漏洞

PwnDoc is a penetration test report generator from the PwnDoc open source. A path traversal vulnerability exists in PwnDoc versions prior to 1.2.0, which stems from the backup recovery feature allowing the import of raw data containing path traversals, which could lead to remote code execution...

The vulnerability of PDF-XChange Editor’s document viewing and editing software lies in the possibility of an operation going beyond the buffer in memory, allowing attackers to execute arbitrary code.

The vulnerability of PDF-XChange Editor’s PDF document viewing and editing functionality lies in the issue of operations going beyond the buffer in memory when processing Doc objects. Exploiting this vulnerability can allow attackers to execute arbitrary code...

CVE-2025-0901

PDF-XChange Editor Doc Object Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a...

CVE-2025-0901

CVE-2025-0901 concerns PDF-XChange Editor. Connected sources confirm a vulnerability in the handling of Doc objects that enables an out-of-bounds read, which attackers can exploit to run code in the context of the affected process. The flaw arises from insufficient validation of user-supplied dat...

Tracker Software PDF-XChange Editor 缓冲区错误漏洞

Tracker Software PDF-XChange Editor is a suite of software for viewing and editing PDF format files from Tracker Software, a Canadian company. A buffer error vulnerability exists in Tracker Software PDF-XChange Editor, which stems from the Doc Object module containing an out-of-bounds read issue...