94476 matches found
CVE-2026-62601
...
CVE-2026-62553
...
CVE-2026-62458
Oracle E-Business Suite (component: Internal Operations of Work in Process) versions 12.2.3–12.2.15 are affected by a HIGH-severity (CVSS 7.1) vulnerability exploitable over HTTP by a low-privileged attacker, enabling denial-of-service (hang/crash) and unauthorized data modification. No in-the-wi...
CVE-2026-61332
...
CVE-2026-61008
...
CVE-2026-60722
...
EUVD-2026-61490
linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations. Prior to version 4.2.0, dbsqlite.py created SQLite databases at predictable paths in the shared /tmp directory and followed attacker-created symbolic links at those paths. An attacker who...
CVE-2026-53759 linuxfabrik-lib: Insecure creation of SQLite databases
linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations. Prior to version 4.2.0, dbsqlite.py created SQLite databases at predictable paths in the shared /tmp directory and followed attacker-created symbolic links at those paths. An attacker who...
Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration
Summary A second-order SQL injection vulnerability in Froxlor's admin API allows an authenticated administrator to store a crafted SQL payload in the paneladmins.ip column via the Admins.add or Admins.update endpoint. The payload executes as a UNION-based SQL injection the next time...
SQL Injection
Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to SQL Injection in the ipaddress parameter of the Admins.add or Admins.update process. An attacker can extract sensitive database information, including administrator login names and...
GHSA-W27M-RMMF-G5W4 Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration
Summary A second-order SQL injection vulnerability in Froxlor's admin API allows an authenticated administrator to store a crafted SQL payload in the paneladmins.ip column via the Admins.add or Admins.update endpoint. The payload executes as a UNION-based SQL injection the next time...
GHSA-M5PQ-69XG-VCQ3 devpi-server may leak database contents
Impact If the replication protocol is enabled by using the primary or deprecated master role for a server instance, then the +changelog URL route can be used to read the complete database content including password hashes, and the ids and salts of tokens from devpi-tokens by using a trivially...
CVE-2026-54348
Froxlor (open-source server administration panel) prior to 2.3.8 is affected by a second-order SQL injection in its admin API. The Admins.add/Admins.update endpoints store an attacker-controlled ipaddress array as JSON in panel_admins.ip without numeric type enforcement. When the poisoned account...
CVE-2026-54348 Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration
Froxlor is open source server administration software. Prior to 2.3.8, the Admins.add and Admins.update endpoints in lib/Froxlor/Api/Commands/Admins.php accept an attacker-controlled ipaddress array and store it as JSON in paneladmins.ip without enforcing numeric element types. When the poisoned...
CVE-2026-54348 Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration
Froxlor is open source server administration software. Prior to 2.3.8, the Admins.add and Admins.update endpoints in lib/Froxlor/Api/Commands/Admins.php accept an attacker-controlled ipaddress array and store it as JSON in paneladmins.ip without enforcing numeric element types. When the poisoned...
CVE-2026-54348 Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration
Froxlor is open source server administration software. Prior to 2.3.8, the Admins.add and Admins.update endpoints in lib/Froxlor/Api/Commands/Admins.php accept an attacker-controlled ipaddress array and store it as JSON in paneladmins.ip without enforcing numeric element types. When the poisoned...
EUVD-2026-61150
Lemur manages TLS certificate creation. Prior to 1.9.2, lemur.users.service.update assigned a replacement password directly to users.password, while lemur/users/models.py registered User.hashpassword only for the beforeinsert event. Because no beforeupdate listener ran, administrator-initiated...
CVE-2026-55164
Netflix Lemur before 1.9.2 stores admin-set passwords in plaintext: lemur.users.service.update() assigns the password directly to User.password without calling hash_password(), and the model only registers a bcrypt before_insert listener, not before_update. A database or backup compromise exposes...
CVE-2026-52723
creationtimestamp| type| source ---|---|--- 2026-08-18 18:10:18+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtestjgtg72p 2026-08-18 19:10:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtew6fc7cl2j...
SUSE-SU-2026:23192-1 Security update for rpm
This update for rpm fixes the following issue: - CVE-2026-44605: heap buffer overflow in NDB database backend due to unchecked 32-bit arithmetic when parsing the slot table bsc1269584...