4540 matches found
CVE-2026-20242 Cisco Secure Firewall Management Center Software Java Deserialization Remote Code Execution Vulnerability
A vulnerability in the External Database Access feature of Cisco Secure Firewall Management Center FMC Software could allow an unauthenticated, remote attacker to execute arbitrary commands as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Jav...
Cisco Secure Firewall Management Center Software Java Deserialization Remote Code Execution Vulnerability
A vulnerability in the External Database Access feature of Cisco Secure Firewall Management Center FMC Software could allow an unauthenticated, remote attacker to execute arbitrary commands as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Jav...
CVE-2026-76449: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the...
CVE-2026-20242: Deserialization of Untrusted Data
A vulnerability in the External Database Access feature of Cisco Secure Firewall Management Center FMC Software could allow an unauthenticated, remote attacker to execute arbitrary commands as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Jav...
CVE-2026-20344: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, remote attacker to perform a SQL injection attack against an affected device. To exploit this vulnerability, the attacker must have a valid account on the device with the role of...
PT-2026-93963
Name of the Vulnerable Software and Affected Versions Cisco Secure Firewall Management Center FMC Software affected versions not specified Description A flaw in the External Database Access feature allows an unauthenticated remote attacker to execute arbitrary commands with root privileges. The...
CVE-2026-20300: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability in Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected device. To exploit this vulnerability, the attacker must have at least low-privileged administrative credentials. This vulnerability is due to improper validation of...
PT-2026-93786
Name of the Vulnerable Software and Affected Versions code-projects Matrimonial System version 1.0 Description An SQL injection issue exists in the Regular Search component within the '/search.php' endpoint. A remote attacker can exploit this by manipulating the sex, mothertongue, maritialstatus,...
CVE-2026-91924 pgweb through 0.17.0 Missing Authorization on Direct Connect Endpoint
pgweb through 0.17.0 leaves the POST /api/connect endpoint unguarded when connect-backend authorization is configured, allowing attackers to supply arbitrary database connection strings. Attackers can bypass the resource-to-database mapping by providing a custom session identifier and connection...
CVE-2026-91924 pgweb through 0.17.0 Missing Authorization on Direct Connect Endpoint
pgweb through 0.17.0 leaves the POST /api/connect endpoint unguarded when connect-backend authorization is configured, allowing attackers to supply arbitrary database connection strings. Attackers can bypass the resource-to-database mapping by providing a custom session identifier and connection...
CVE-2026-91924
pgweb versions through 0.17.0 leave the POST /api/connect endpoint unguarded when connect-backend authorization is configured. This allows an attacker with low privileges to supply an arbitrary database connection string, bypassing the intended resource-to-database mapping by providing a custom s...
[SECURITY] Fedora 45 Update: perl-DBI-1.653-1.fc45
DBI is a database access Application Programming Interface API for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used...
CVE-2026-53459: Not Failing Securely
Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Starting in version 0.1.6 and prior to version 0.2.4.4, a fail-open in the authentication code allows any attacker to bypass authentication by flooding a public endpoint to exhaust resources causing database...
PT-2026-91929
Name of the Vulnerable Software and Affected Versions pgweb versions prior to 0.17.1 Description The application fails to implement authorization checks on the 'POST /api/connect' endpoint when connect-backend authorization is configured. This allows an attacker to bypass the resource-to-database...
SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37985)
Sales and Inventory System is a business resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability. This vulnerability arises from the failure to properly validate the user ID parameter input in the...
CVE-2026-79570
mfish-nocode-pro v1.0.0 was discovered to contain a SQL injection vulnerability in the tableName parameter at /sys/dbConnect/data. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...
CVE-2026-78837
A SQL injection vulnerability in the apformid parameter in AppNitro MachForm v30 allows attackers to access sensitive database information via a crafted SQL statement...
CVE-2026-79573
L-ONE v1.0.0 was discovered to contain multiple SQL injection vulnerabilities in the /attachment/getBusinessUploadList component via the busid, id, and taskid parameters. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...
CVE-2026-78837: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability in the apformid parameter in AppNitro MachForm v30 allows attackers to access sensitive database information via a crafted SQL statement...