CVE-2025-26533

An SQL injection risk was identified in the module list filter within course search...

CVE-2025-26533

CVE-2025-26533 describes an SQL injection risk in Moodle’s course search module list filter. Affected: Moodle LMS; component: module list filter in the course search. Root cause: insufficient input filtering in the filter used by course search. Impact: high to critical according to metrics in the...

CVE-2025-26533 SQL injection risk in course search module list filter

An SQL injection risk was identified in the module list filter within course search...

CVE-2025-26533 SQL injection risk in course search module list filter

An SQL injection risk was identified in the module list filter within course search...

CVE-2024-13485

The LTL Freight Quotes – ABF Freight Edition plugin for WordPress is vulnerable to SQL Injection via the 'editid' and 'dropshipeditid' parameters in all versions up to, and including, 3.3.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

Azure Linux 3.0 Security Update: postgresql (CVE-2025-1094)

The version of postgresql installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-1094 advisory. - Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral,...

postgresql: PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation

A flaw was found in PostgreSQL. Due to improper neutralization of quoting syntax, affected versions potentially allow a database input provider to achieve SQL injection in certain usage patterns. Specifically, SQL injection requires the application to use the affected function's result to constru...

postgresql: PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation

A flaw was found in PostgreSQL. Due to improper neutralization of quoting syntax, affected versions potentially allow a database input provider to achieve SQL injection in certain usage patterns. Specifically, SQL injection requires the application to use the affected function's result to constru...

CVE-2024-13676

CVE-2024-13676 affects the WordPress plugin Categorized Gallery Plugin (

CVE-2024-13712

CVE-2024-13712 affects the WordPress Pollin plugin. The vulnerability is an unauthenticated SQL Injection via the plugin’s question parameter, in all versions up to and including 1.01.1. Root cause is insufficient escaping of user-supplied input and lack of proper SQL query parameterization. Impa...

PT-2025-7789 · Moodle +5 · Moodle +1

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: A risk related to SQL injection was identified in the module list filter within the course search functionality. Recommendations: At the moment, there is no information about a newer version...

PT-2025-7062 · Unknown · Luxcal Web Calendar

Name of the Vulnerable Software and Affected Versions: LuxCal Web Calendar versions prior to 5.3.3M MySQL version LuxCal Web Calendar versions prior to 5.3.3L SQLite version Description: The issue concerns an SQL injection vulnerability in the retrieve.php file. If exploited, this vulnerability m...

CVE-2024-29737

In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and...

ROS-20250212-18

A vulnerability in the "Host Monitoring" component of the Zabbix universal monitoring system is related to incorrect code generation control. code generation control. Exploitation of the vulnerability could allow an attacker acting remotely, execute arbitrary code by injecting it into the ping...

Azure Linux 3.0 Security Update: python-twisted (CVE-2024-41810)

The version of python-twisted installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-41810 advisory. - Twisted is an event-based framework for internet applications, supporting Python 3.6+. The...

Azure Linux 3.0 Security Update: edk2 / hvloader / openssl (CVE-2022-1292)

The version of edk2 / hvloader / openssl installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-1292 advisory. - The crehash script does not properly sanitise shell metacharacters to prevent command...

CVE-2022-2718

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter on the joomsport-page-extrafields page in versions up to, and including, 5.2.5 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2024-43160

Unrestricted Upload of File with Dangerous Type vulnerability in BerqWP allows Code Injection.This issue affects BerqWP: from n/a through 1.7.6...

BIT-SUPERSET-2024-24772 Apache Superset: Improper Neutralisation of custom SQL on embedded context

A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying analytics database.This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, whi...

CVE-2024-8669

The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the 'options' parameter passed to the backuplywpclonesql function in all versions up to, and including, 1.3.4 due to insufficient escaping on the user supplied parameter and lack of sufficien...