EUVD-2022-4370

Malicious code in bioql PyPI...

EUVD-2022-1433

Malicious code in bioql PyPI...

EUVD-2024-50253

Malicious code in bioql PyPI...

EUVD-2024-51603

Malicious code in bioql PyPI...

EUVD-2022-42835

Malicious code in bioql PyPI...

EUVD-2021-9093

Malicious code in bioql PyPI...

EUVD-2025-18116

Malicious code in bioql PyPI...

EUVD-2024-22910

Malicious code in bioql PyPI...

EUVD-2025-21393

Malicious code in bioql PyPI...

EUVD-2022-39041

Malicious code in bioql PyPI...

EUVD-2023-32972

Malicious code in bioql PyPI...

Improper Neutralization of Data within XPath Expressions ('XPath Injection')

Overview smolagents is a 🤗 smolagents: a barebones library for agents. Agents write python code to call tools or orchestrate other agents. Affected versions of this package are vulnerable to Improper Neutralization of Data within XPath Expressions 'XPath Injection' via the searchitemctrlf functio...

CVE-2025-52041

In Frappe ERPNext 15.57.5, the function getstockbalancefor at erpnext/stock/doctype/stockreconciliation/stockreconciliation.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the inventorydimensionsdict parameter...

EUVD-2025-30225

A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection...

CVE-2025-35431 CISA Thorium LDAP injection

CISA Thorium does not escape user controlled strings used in LDAP queries. An authenticated remote attacker can modify LDAP authorization data such as group memberships. Fixed in 1.1.1...

CVE-2025-10565

CVE-2025-10565 affects Campcodes Grocery Sales and Inventory System 1.0. A SQL injection exists in the /ajax.php?action=delete_receiving endpoint, triggered by manipulating the ID parameter. Several connected sources confirm remote exploitation possibilities and public disclosure of the exploit. ...

CVE-2025-34187

Ilevia EVE X1/X5 Server version ≤ 4.7.18.0.eden contains a misconfiguration in the sudoers file that allows passwordless execution of certain Bash scripts. If these scripts are writable by web-facing users or accessible via command injection, attackers can replace them with malicious payloads...

CVE-2025-8276

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting', Improper Encoding or Escaping of Output, Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in Patika Global Technologies HumanSuite allows...

SQL Injection

Django is vulnerable to SQL Injection. The vulnerability is due to improper sanitization of column aliases in FilteredRelation when crafted dictionaries are expanded as keyword arguments to QuerySet.annotate or QuerySet.alias, which allows an attacker to inject and execute arbitrary SQL...

CVE-2025-58450

Summary: CVE-2025-58450 affects pREST (PostgreSQL REST), a REST API on top of PostgreSQL. The vulnerability is a SQL injection in versions prior to 2.0.0-rc3 due to inadequate validation; a patch exists in 2.0.0-rc3. The primary risk details indicate high impact on confidentiality, integrity, and...