Embedded Malicious Code

Overview @emilgroup/discount-sdk is an A new version of the package Affected versions of this package are vulnerable to Embedded Malicious Code. The publishing pipeline of this package was compromised as the result of Trivy's GitHub Actions compromise and a malicious versions were released on NPM...

CVE-2025-40639

A SQL injection vulnerability has been found in Eventobot. This vulnerability allows an attacker to retrieve, create, update and delete databases through the 'promosend' parameter in the '/assets/php/calculatediscount.php'...

EUVD-2025-208400

A SQL injection vulnerability has been found in Eventobot. This vulnerability allows an attacker to retrieve, create, update and delete databases through the 'promosend' parameter in the '/assets/php/calculatediscount.php'...

EUVD-2025-208399

A SQL injection vulnerability has been found in Eventobot. This vulnerability allows an attacker to retrieve, create, update and delete databases through the 'promosend' parameter in the '/assets/php/calculatediscount.php'...

CVE-2025-40639

A SQL injection vulnerability has been found in Eventobot. This vulnerability allows an attacker to retrieve, create, update and delete databases through the 'promosend' parameter in the '/assets/php/calculatediscount.php'...

CVE-2025-40639

CVE-2025-40639 — Eventobot SQL injection is confirmed by connected sources. The vulnerability affects Eventobot and is exploitable via the promo_send parameter in the /assets/php/calculate_discount.php endpoint. The underlying issue allows an attacker to perform SQL operations including retrieve,...

CVE-2025-40639 SQL injection in Eventobot

A SQL injection vulnerability has been found in Eventobot. This vulnerability allows an attacker to retrieve, create, update and delete databases through the 'promosend' parameter in the '/assets/php/calculatediscount.php'...

CVE-2025-40639 SQL injection in Eventobot

A SQL injection vulnerability has been found in Eventobot. This vulnerability allows an attacker to retrieve, create, update and delete databases through the 'promosend' parameter in the '/assets/php/calculatediscount.php'...

PT-2026-24051

A SQL injection vulnerability has been found in Eventobot. This vulnerability allows an attacker to retrieve, create, update and delete databases through the 'promo send' parameter in the '/assets/php/calculate discount.php'...

CVE-2025-41002

SQL injection vulnerability in Infoticketing. This vulnerability allows an unauthenticated attacker to retrieve, create, update, and delete the database by sending a POST request using the 'code' parameter in '/components/cart/cartApplyDiscount.php'...

CVE-2025-41002

SQL injection vulnerability in Infoticketing. This vulnerability allows an unauthenticated attacker to retrieve, create, update, and delete the database by sending a POST request using the 'code' parameter in '/components/cart/cartApplyDiscount.php'...

CVE-2025-41002 SQL injection in Infoticketing

SQL injection vulnerability in Infoticketing. This vulnerability allows an unauthenticated attacker to retrieve, create, update, and delete the database by sending a POST request using the 'code' parameter in '/components/cart/cartApplyDiscount.php'...

CVE-2025-41002

SQL injection vulnerability in Infoticketing. This vulnerability allows an unauthenticated attacker to retrieve, create, update, and delete the database by sending a POST request using the 'code' parameter in '/components/cart/cartApplyDiscount.php'...

CVE-2025-41002 SQL injection in Infoticketing

SQL injection vulnerability in Infoticketing. This vulnerability allows an unauthenticated attacker to retrieve, create, update, and delete the database by sending a POST request using the 'code' parameter in '/components/cart/cartApplyDiscount.php'...

CVE-2025-41002

CVE-2025-41002 is a SQL injection vulnerability in Infoticketing. An unauthenticated attacker can abuse a POST request to the path /components/cart/cartApplyDiscount.php using the 'code' parameter to retrieve, create, update, and delete data in the database. The CVSS metrics indicate a critical s...

PT-2026-21508

SQL injection vulnerability in Infoticketing. This vulnerability allows an unauthenticated attacker to retrieve, create, update, and delete the database by sending a POST request using the 'code' parameter in '/components/cart/cartApplyDiscount.php'...

MANANTIAL DE IDEAS Infoticketing SQL注入漏洞

MANANTIAL DE IDEAS Infoticketing is a one-stop ticketing system provided by the Spanish company MANANTIAL DE IDEAS. MANANTIAL DE IDEAS Infoticketing has a SQL injection vulnerability, which stems from improper handling of the code parameter in the components/cart/cartApplyDiscount.php file. This...

WordPress WP eStore plugin < 8.5.5 - Reflected XSS in Discount Editing vulnerability

Reflected XSS in Discount Editing vulnerability discovered by Bob Matyas in WordPress Plugin WP eStore versions 8.5.5...

a2grunnerp (>=0.1.0 <=0.1.8), a4t-sale-discount (=5.0.2) +2911 more potentially affected by CVE-2026-21860 via werkzeug (>=0.10.1 <=3.1.4)

werkzeug PYPI version =0.10.1, =0.1.0, =1.0.2, =1.0.5, =0.10.3, =1.8.8, =0.3.1, =0.8.44.4, =4.2.0, =1.0.0, =0.4.0, =0.1.3, =0.9.2, =0.9.4 and more Source cves: CVE-2026-21860 Source advisory: OSV:GHSA-87HC-H4R5-73F7...

a4t-sale-discount (=5.0.2), kalenis-lims (>=4.8.0 <=5.0.0) +260 more potentially affected by CVE-2025-66422 via trytond (>=4.0.20 <=5.8.16)

trytond PYPI version =4.0.20, =4.8.0, =5.4.0, =5.2.0, =5.2.0, =5.2.0, =5.2.0, =5.2.2, =5.2.0, =5.2.0, =5.2.0, =5.2.2 - m9s-account-invoice-report-filestore =5.2.0 and more Source cves: CVE-2025-66422 Source advisory: OSV:GHSA-JQFC-9Q34-PRHG...