EUVD-2022-52310

Malicious code in bioql PyPI...

EUVD-2025-24869

Malicious code in bioql PyPI...

EUVD-2025-30810

Malicious code in bioql PyPI...

EUVD-2025-24677

Malicious code in bioql PyPI...

EUVD-2025-25617

Malicious code in bioql PyPI...

EUVD-2025-24950

Malicious code in bioql PyPI...

EUVD-2025-28403

Malicious code in bioql PyPI...

EUVD-2025-28906

Malicious code in bioql PyPI...

EUVD-2025-31389

Malicious code in bioql PyPI...

CVE-2025-54153

An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.2 2025/07/31...

CVE-2025-54153

An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.2 2025/07/31...

CVE-2024-56804

An SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.4 and later...

EUVD-2025-32325

An SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.4 and later...

CVE-2025-40636

The CVE-2025-40636 entry describes a SQL injection in the Joomla module mod_vvisit_counter (version v2.0.4j3 ). The vulnerability stems from improper handling of the cookie parameter cip_vvisitcounter , allowing an attacker to retrieve database content at endpoints where the plugin counts visits....

CVE-2025-10582 WP Dispatcher <= 1.2.0 - Authenticated (Contributor+) SQL Injection

The WP Dispatcher plugin for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticat...

CVE-2025-10726 WPRecovery <= 2.0 - Unauthenticated SQL Injection to Arbitrary File Deletion

The WPRecovery plugin for WordPress is vulnerable to SQL Injection via the 'dataid' parameter in all versions up to, and including, 2.0. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

PT-2025-40486

Name of the Vulnerable Software and Affected Versions Wp cycle text announcement plugin for WordPress versions through 8.1 Description The Wp cycle text announcement plugin for WordPress is susceptible to SQL Injection through the 'cycle-text' shortcode. Insufficient escaping of user-supplied...

PT-2025-40597

Name of the Vulnerable Software and Affected Versions OpenSupports versions 4.11.0 Description The application’s API endpoint, /api/staff/get-new-tickets, directly incorporates the user-supplied parameter departmentId into a SQL query without proper sanitization. This allows an authenticated staf...

openSUSE Security Advisory (SUSE-SU-2025:03446-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OpenSupports SQL注入漏洞

OpenSupports is a simple open source ticketing platform from OpenSupports Open Source. An SQL injection vulnerability exists in OpenSupports version 4.11.0, which stems from directly splicing the user-controlled parameter departmentId into the SQL WHERE clause without using parameter binding, whi...