CVE-2024-13533

The Small Package Quotes – USPS Edition plugin for WordPress is vulnerable to SQL Injection via the 'editid' parameter in all versions up to, and including, 1.3.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes i...

CVE-2025-26615

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Path Traversal vulnerability was discovered in the WeGIA application, examples.php endpoint. This vulnerability could allow an attacker to gain unauthorized access to sensitive information stored in...

CVE-2025-26615

CVE-2025-26615 affects WeGIA prior to 3.2.14, via a path traversal in the examples.php endpoint parameter 'src' that could disclose contents of config.php, potentially exposing database access details. The issue has been addressed in version 3.2.14; upgrade to mitigate. No public workarounds are ...

CVE-2025-26616

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Path Traversal vulnerability was discovered in the WeGIA application, "exportardump.php" endpoint. This vulnerability could allow an attacker to gain unauthorized access to sensitive information stor...

CVE-2025-26616

WeGIA (open source Web Manager) contains a Path Traversal vulnerability in the exportar_dump.php endpoint that could disclose sensitive data in config.php, potentially enabling direct database access. Affected versions are prior to 3.2.14. The issue has been addressed in version 3.2.14, and users...

CVE-2025-26616 Path Traversal endpoint 'exportar_dump.php' parameter 'file' in WeGIA

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Path Traversal vulnerability was discovered in the WeGIA application, exportardump.php endpoint. This vulnerability could allow an attacker to gain unauthorized access to sensitive information stored...

CVE-2025-25221

The LuxCal Web Calendar prior to 5.3.3M MySQL version and prior to 5.3.3L SQLite version contains an SQL injection vulnerability in pdf.php. If this vulnerability is exploited, information in a database may be deleted, altered, or retrieved...

Learning Digital Orca HCM SQL注入漏洞

Learning Digital Orca HCM is a digital learning platform from China-based Learning Digital. Learning Digital Orca HCM suffers from a SQL injection vulnerability that stems from improper handling of SQL queries. An attacker can inject arbitrary SQL commands to read, modify, or delete database...

Pimcore Customer Data Framework SQL Injection Vulnerability

Pimcore is Austria Pimcore company's set of open source for creating and managing Web applications Web content management platform. The platform integrates Web content management, e-commerce framework and product information management applications. An SQL injection vulnerability exists in Pimcor...

CVE-2024-52895

IBM i 7.4 and 7.5 is vulnerable to a database access denial of service caused by a bypass of a database capabilities restriction check. A privileged bad actor can remove or otherwise impact database infrastructure files resulting in incorrect behavior of software products that rely upon the...

CVE-2024-52895

CVE-2024-52895 affects IBM i 7.4, 7.5 (and 7.6 per IBM bulletin). The issue is a vulnerability where a bypass of a database capabilities restriction check allows a privileged attacker to remove or alter database infrastructure files, leading to a denial of service and possible incorrect behavior ...

CVE-2024-52895 IBM i denial of service

IBM i 7.4 and 7.5 is vulnerable to a database access denial of service caused by a bypass of a database capabilities restriction check. A privileged bad actor can remove or otherwise impact database infrastructure files resulting in incorrect behavior of software products that rely upon the...

CVE-2024-52895 IBM i denial of service

IBM i 7.4 and 7.5 is vulnerable to a database access denial of service caused by a bypass of a database capabilities restriction check. A privileged bad actor can remove or otherwise impact database infrastructure files resulting in incorrect behavior of software products that rely upon the...

CVE-2022-28132

The T-Soft E-Commerce 4 web application is susceptible to SQL injection SQLi attacks when authenticated as an admin or privileged user. This vulnerability allows attackers to access and manipulate the database through crafted requests. By exploiting this flaw, attackers can bypass authentication...

CVE-2024-28061

An issue was discovered in Apiris Kafeo 6.4.4. It permits a bypass, of the protection in place, to access to the data stored in the embedded database file...

PT-2025-6711 · Ibm · Ibm I

Name of the Vulnerable Software and Affected Versions: IBM i versions 7.4 through 7.5 Description: A database access denial of service can occur due to a bypass of a database capabilities restriction check. This allows a privileged bad actor to remove or impact database infrastructure files,...

CVE-2024-52895: Improper Check for Unusual or Exceptional Conditions

IBM i 7.4 and 7.5 is vulnerable to a database access denial of service caused by a bypass of a database capabilities restriction check. A privileged bad actor can remove or otherwise impact database infrastructure files resulting in incorrect behavior of software products that rely upon the...

CVE-2025-24500

The vulnerability allows an unauthenticated attacker to access information in PAM database...

WhoDB has a path traversal opening Sqlite3 database

Summary While the application only displays Sqlite3 databases present in the directory /db, there is no path traversal prevention in place. This allows an unauthenticated attacker to open any Sqlite3 database present on the host machine that the application is running on. Details WhoDB allows use...

GHSA-9R4C-JWX3-3J76 WhoDB has a path traversal opening Sqlite3 database

Summary While the application only displays Sqlite3 databases present in the directory /db, there is no path traversal prevention in place. This allows an unauthenticated attacker to open any Sqlite3 database present on the host machine that the application is running on. Details WhoDB allows use...