363 matches found
CVE-2026-5963 Digiwin｜EasyFlow .NET - SQL Injection
EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents...
CVE-2026-5963
The CVE-2026-5963 entry concerns EasyFlow .NET from Digiwin with a SQL Injection vulnerability. The issue allows unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents. According to the connected sources, the affected product is EasyFlow .N...
CVE-2026-5963: Improper Neutralization of Special Elements used in an SQL Command
EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents...
CVE-2026-5964: Improper Neutralization of Special Elements used in an SQL Command
EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents...
Exploit for SQL Injection in Devcode Openstamanager
CVE-2026-24418: OpenSTAManager has a SQL Injection vulnerabili...
PT-2026-28626
Name of the Vulnerable Software and Affected Versions Fleet versions prior to 4.81.0 Description Fleet is open source device management software susceptible to a second-order SQL injection in its Apple MDM profile delivery pipeline. An attacker possessing a valid MDM enrollment certificate could...
CVE-2026-33651
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the "remindMe.json.php" endpoint passes "$REQUEST'livescheduleid'" through multiple functions without sanitization until it reaches "Schedulercommands::getAllActiveOrToRepeat", which directly concatenates it into ...
CVE-2026-33485
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the RTMP onpublish callback at plugin/Live/onpublish.php is accessible without authentication. The $POST'name' parameter stream key is interpolated directly into SQL queries in two locations —...
CVE-2026-33485
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the RTMP "onpublish" callback at "plugin/Live/onpublish.php" is accessible without authentication. The "$POST'name'" parameter stream key is interpolated directly into SQL queries in two locations —...
EUVD-2019-19727
Simple Job Script contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting malicious SQL code through the appid parameter. Attackers can send POST requests to deleteapplicationajax.php with crafted payloads to extract sensitive data, bypass...
CVE-2026-2236
C@il developed by HGiga has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents...
CVE-2026-2096
Agentflow developed by Flowring has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and delete database contents by using a specific functionality...
CVE-2026-2093
Docpedia developed by Flowring has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents...
CVE-2026-2096 Flowring｜Agentflow - Missing Authenticaton
Agentflow developed by Flowring has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and delete database contents by using a specific functionality...
CVE-2026-2093
Docpedia (Flowring) has an unauthenticated SQL Injection vulnerability that allows remote attackers to inject arbitrary SQL to read database contents. The issue is triggered via unauthenticated access and can lead to leakage of confidential data (CVE-2026-2093). CVSS metrics provided indicate hig...
PT-2026-7234
Name of the Vulnerable Software and Affected Versions Docpedia affected versions not specified Description Docpedia, developed by Flowring, exhibits a SQL Injection issue. This allows attackers who do not need to log in to inject and execute arbitrary SQL commands, potentially leading to...
CVE-2026-2093: Improper Neutralization of Special Elements used in an SQL Command
Docpedia developed by Flowring has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents...
CVE-2026-2236
C&Cm@il developed by HGiga has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents...
