CVE-2019-14529

CVE-2019-14529 OpenEMR 项目中的多个 SQL 注入漏洞 漏洞文件中的漏洞函数： /openemr/interface/forms/eyemag/save.php 条件 ：任意授权用户 受影响版本： 5.0.2，已在 5.0.2 版本中修复。 描述 存在两个函数： 1. "storePDF"，使用了未经过滤的变量 "encounter"， 2. "canvas"，使用了两个未经过滤的变量 "encounter" 和 "zone"。 这两个函数都在 DELETE SQL 查询中使用这些变量，且没有任何过滤。这两个变量均可由攻击者控制。 错误消息包含 SQL 查询代码和...

Improper Neutralization of Special Elements in Data Query Logic

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic via the MilvusVectorStoredoDeleteList implementation. An attacker can inject filter expressions by supplying crafted document IDs that are not properly sanitized before bei...

PT-2026-30501

Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the id to delete parameter. Attackers can send crafted requests with malicious SQL statements in the id to delete field to extract or modify sensitive...