31304 matches found
CVE-2026-65875
BaserCMS provided by baserCMS Users Community contains a CSV file injection vulnerability. If a user downloads and opens a CSV file containing malicious code injected by an attacker, the malicious code may be executed...
EUVD-2026-52014
BaserCMS provided by baserCMS Users Community contains a CSV file injection vulnerability. If a user downloads and opens a CSV file containing malicious code injected by an attacker, the malicious code may be executed...
CVE-2026-13596 Participants Database < 2.7.8.4 - Unauthenticated SQL Injection via List Search
The Participants Database WordPress plugin before 2.7.8.4 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks...
PT-2026-66859
Name of the Vulnerable Software and Affected Versions SourceCodester Modern Loan Management System version 1.0 Description An issue exists in the 'ajaxData.php' endpoint where improper handling of the district id, division id, region id, and ward id parameters allows for SQL Injection. SQL...
Qnap QTS and QuTS hero OS Command Injection (CVE-2026-22893)
A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS...
BIT-PYTHON-MIN-2026-0864 Configuration Injection via Carriage Return (\r) in write() method
When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters \r the resulting file could be injected with unexpected keys and values if the attacker controls the written value...
CVE-2026-15929
CVE-2026-15929 describes an SQL injection vulnerability in LG Electronics SmartShare. The issue arises from improper neutralization of special elements in SQL commands, affecting SmartShare up to version 2.3.1712.1202 on Windows 10 and earlier. The CVSS data indicates an adjacent attack vector wi...
CVE-2026-17853
Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to inject scripts or HTML into a privileged page via a crafted HTML page. Chromium security severity: Medium...
EUVD-2025-210536
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in savestud.php via the parameters fname, lname, and studentclass...
CVE-2025-69936
CodeAstro Membership Management System 1.0 is affected by a SQL Injection in /edit_member.php?id=1. The CVE entry has a base CVSS v3.1 score of 9.8 (CRITICAL) with network attack vector, no privileges, no user interaction required, and impacts to confidentiality, integrity, and availability. Root...
CVE-2025-69936
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /editmember.php?id=1...
CVE-2025-69934
The CVE-2025-69934 entry concerns CodeAstro Membership Management System 1.0 and has a concrete flaw: SQL Injection in /delete_members.php?id=1. The issue is tied to the delete_members.php parameter handling, with CVSS 3.1 metrics showing a Network attack vector, no privileges required, no user i...
EUVD-2025-210562
SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in customeredit.php?id=1...
PT-2026-66612
Name of the Vulnerable Software and Affected Versions Kamaji versions prior to 26.7.4-edge Description The PostgreSQL and MySQL datastore drivers build Data Definition Language DDL statements by interpolating user-supplied DataStoreUsername and DataStoreSchema directly into SQL using fmt.Sprintf...
EUVD-2025-210558
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /printmembershipcard.php?id=1...
CVE-2025-69931
CVE-2025-69931 affects CodeAstro Membership Management System 1.0. A SQL Injection vulnerability is exposed in the endpoint /delete_membership.php?id=1, enabling an attacker to potentially manipulate the database. The CVSS v3.1 base score is 9.8 (CRITICAL), with impact on confidentiality, integri...
WP2Shell WordPress Exploit Technical Analysis and Real Attack Data
On July 17th, 2026, the WordPress Security Team released updates to WordPress core addressing a critical vulnerability chain that can be leveraged by unauthenticated attackers to create an administrator account and then execute code through normal administrator capabilities, such as uploading a...
CVE-2026-54666
swagger-typescript-api contains a code-injection risk in generated API clients prior to 13.12.2. OpenAPI path keys are passed through parseRouteName into template code without escaping template literals, causing attacker-controlled paths containing ${...} to be evaluated when a generated method r...
CVE-2026-54661 swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template
swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers0.url from src/code-gen-process.ts into the HttpClient constructor without escaping, allowing an attacker-controll...