EUVD-2024-30754

Malicious code in bioql PyPI...

CVE-2025-54474

CVE-2025-54474 describes a SQL injection vulnerability in the DJ-Classifieds Joomla extension, affecting versions 3.9.2–3.10.1. The issue allows privileged users to execute arbitrary SQL commands. The connected documents consistently reference a DJ-Classifieds SQLi impacting Joomla; no exploitati...

CVE-2019-13076

Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary commands against the database. The affected component is /userui/ticketlist.php, and affected parameters are order0column and order0dir...

WordPress plugin Mailing Group Listserv SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...

CVE-2024-47189

The API Interface of the AWV Audio, Web and Video Conferencing component of Mitel MiCollab through 9.8 SP1 FP2 9.8.1.201 could allow an unauthenticated attacker to conduct SQL injection due to insufficient sanitization of user input. A successful exploit could allow an attacker with knowledge of...

GHSA-H7CM-JVPP-69XF Meshery SQL Injection vulnerability

Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications. A SQL injection vulnerability in Meshery prior to version 0.7.22 may lead to arbitrary file write by using a SQL injection stacked queries payload, and the...

SQL Injection

Meshery is vulnerable to SQL Injection. The vulnerability is due to improper handling of the sort query parameter in the GetAllEvents function, allowing for SQL injection through stacked queries and the ATTACH DATABASE command...

GHSA-W3Q8-M492-4PWP Possibility to circumvent the invitation token expiry period

Impact The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality. When using the password reset functionality, the deviseinvitable gem always accepts the pending invitation if the user has been invited as shown in this piece...

CVE-2023-4833

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Besttem Network Marketing Software allows SQL Injection. This issue affects Network Marketing Software: before 1.0.2309.6...

CVE-2023-3522

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in a2 License Portal System allows SQL Injection.This issue affects License Portal System: before 1.48...

PT-2023-25756 · Unknown · Food Ordering System

Name of the Vulnerable Software and Affected Versions: Food Ordering System version 1.0 Description: A SQL Injection issue allows attackers to execute commands on the database by sending crafted SQL queries to the ID parameter. Recommendations: For Food Ordering System version 1.0, avoid using th...

SUSE CVE-2008-4865

Untrusted search path vulnerability in valgrind before 3.4.0 allows local users to execute arbitrary programs via a Trojan horse .valgrindrc file in the current working directory, as demonstrated using a malicious --db-command options. NOTE: the severity of this issue has been disputed, but CVE i...

postgresql: server processes unencrypted bytes from man-in-the-middle

It was found that a PostgreSQL server could accept plain text data during the establishment of an SSL connection. When a user is requesting a certificate based authentication, an active Person in the Middle could use this flaw in order to inject arbitrary SQL commands...

CVE-2021-32590

Multiple improper neutralization of special elements used in an SQL command vulnerabilities in FortiPortal 6.0.0 through 6.0.4, 5.3.0 through 5.3.5, 5.2.0 through 5.2.5, and 4.2.2 and earlier may allow an attacker with regular user's privileges to execute arbitrary commands on the underlying SQL...

CVE-2020-12014

Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Input is not properly sanitized and may allow an attacker to inject SQL commands...

CVE-2019-3661

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' in McAfee Advanced Threat Defense ATD prior to 4.8 allows remote authenticated attacker to execute database commands via carefully constructed time based payloads...

ZZCMS SQL Injection Vulnerability (CNVD-2019-24373)

ZZCMS is a content management system CMS by the ZZCMS team in China. A SQL injection vulnerability exists in ZZCMS 8.3 and earlier versions. The vulnerability stems from a lack of validation of externally entered SQL statements in database-based applications. An attacker can exploit this...

OpenEMR Arbitrary SQL Command Execution Vulnerability

OpenEMR is an open source medical management system maintained by the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing requests. A security vulnerability exists in the interface\super\editlist.php file ...

MuM MapEdit has multiple vulnerabilities

MuM MapEdit is software that provides data to the Internet and intranet to facilitate community and government infrastructure. MapEdit version 3.2.6.0 suffers from arbitrary file upload, arbitrary file download, and arbitrary SQL command execution vulnerabilities, which can be exploited by...

VulnCheck KEV: CVE-2012-1557

SQL injection vulnerability in admin/plib/api-rpc/Agent.php in Parallels Plesk Panel 7.x and 8.x before 8.6 MU2, 9.x before 9.5 MU11, 10.0.x before MU13, 10.1.x before MU22, 10.2.x before MU16, and 10.3.x before MU5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...