PT-2025-27594 · WordPress · The Ads Pro Plugin

Name of the Vulnerable Software and Affected Versions: The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager versions up to, and including, 4.89 Description: The issue allows for SQL Injection via the oid parameter due to insufficient escaping on the user-supplied parameter and lack of...

CVE-2025-53091 WeGIA has Unauthenticated Time-Based Blind SQL Injection in almox Parameter

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Time-Based Blind SQL Injection vulnerability was discovered in version 3.3.3 the almox parameter of the /controle/getProdutosPorAlmox.php endpoint. This issue allows any unauthenticated...

filebrowser Sets Insecure File Permissions

Summary The file access permissions for files uploaded to or created from File Browser are never explicitly set by the application. The same is true for the database used by File Browser. On standard servers where the umask configuration has not been hardened before, this makes all the stated fil...

GHSA-JJ2R-455P-5GVF filebrowser Sets Insecure File Permissions

Summary The file access permissions for files uploaded to or created from File Browser are never explicitly set by the application. The same is true for the database used by File Browser. On standard servers where the umask configuration has not been hardened before, this makes all the stated fil...

PT-2025-27101

Name of the Vulnerable Software and Affected Versions: ThemeMove Amely versions n/a through 3.1.4 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations:...

SQL Injection Vulnerability in ERP System of Shenzhen Mingyuan Cloud Technology Co.

The ERP system is a comprehensive information management platform that integrates the functions of housing, customers, sales, finance and human resources. ERP system of Shenzhen Mingyuan Cloud Technology Co., Ltd. suffers from SQL injection vulnerability, which can be exploited by attackers to...

PT-2025-26217

Name of the Vulnerable Software and Affected Versions Yirmibes Software MY ERP versions prior to 1.170 Description The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendatio...

PT-2025-25676 · Unknown · Smart Notification

Name of the Vulnerable Software and Affected Versions: Smart Notification versions n/a through 10.3 Description: The issue is related to an SQL Injection vulnerability, specifically a Blind SQL Injection, due to the improper neutralization of special elements used in an SQL command. This allows a...

TencentOS Server 3: postgresql:10 (TSSA-2023:0199)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2023:0199 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

CVE-2025-42983

SAP Business Warehouse and SAP Plug-In Basis allows an authenticated attacker to drop arbitrary SAP database tables, potentially resulting in a loss of data or rendering the system unusable. On successful exploitation, an attacker can completely delete database entries but is not able to read any...

WordPress File Provider plugin SQL Injection Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. WordPress File Provider plugin suffers from a SQL injection vulnerability that stems from the application's lack of validation of externally entered SQL statements. An attacker...

CVE-2025-42983 Missing Authorization check in SAP Business Warehouse and SAP Plug-In Basis

SAP Business Warehouse and SAP Plug-In Basis allows an authenticated attacker to drop arbitrary SAP database tables, potentially resulting in a loss of data or rendering the system unusable. On successful exploitation, an attacker can completely delete database entries but is not able to read any...

CVE-2025-42983

Affected product: SAP Business Warehouse and SAP Plug-In Basis. vulnerability: missing authorization checks allow an authenticated attacker to drop arbitrary SAP database tables and delete entries, potentially causing data loss and system unavailability; no data reading is possible. root cause: l...

PT-2025-24519 · Unknown · Alex Zaytseff Multi Cryptocurrency Payments

Name of the Vulnerable Software and Affected Versions: Alex Zaytseff Multi CryptoCurrency Payments versions n/a through 2.0.3 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injectio...

CVE-2025-5563

The WP-Addpub plugin for WordPress is vulnerable to SQL Injection via the 'wp-addpub' shortcode in all versions up to, and including, 1.2.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2025-4964 WP Online Users Stats <= 1.0.0 - Authenticated (Editor+) SQL Injection via table_name Parameter

The WP Online Users Stats plugin for WordPress is vulnerable to time-based SQL Injection via the ‘tablename’ parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes i...

PT-2025-24250 · Gamipress · Gamipress

Name of the Vulnerable Software and Affected Versions: GamiPress versions n/a through 7.4.5 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations: For...

IBM DB2 DoS (7235069) (Windows)

According to it self-reported version number, IBM Db2 is affected by a remote code execution vulnerability as a database administrator of one database may execute code or read/write files from another database within the same instance. Note that Nessus has not tested for this issue but has instea...

Unsecured Database Exposes Data of 3.6 Million Passion.io Creators

A massive data leak has put the personal information of over 3.6 million app creators, influencers, and entrepreneurs…...

[SECURITY] [DLA 4208-1] mariadb-10.5 security update

From: Otto Kekäläinen [email protected] To: [email protected] Subject: SECURITY DLA 4208-1 mariadb-10.5 security update - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4208-1 [email protected]...