1472 matches found
FineCMS <5.0.9 - Open Redirect
FineCMS 5.0.9 contains an open redirect vulnerability via the url parameter in a sync action. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2017-11586 info: name: FineCMS 5.0.9 - Open...
EUVD-2026-116589
RosarioSIS before 12.9 contains a sql injection vulnerability that allows authenticated non-student users, including parents, to inject SQL via the unquoted periodid parameter in StudentSummary.php. Attackers can supply payloads without single quotes into IN clauses to extract administrator...
Elastic Security Kibana Data Visualization Modifying Data
The vulnerability related to the request handling functionality in the Elastic Security service for Kibana visualization is due to insufficient control over modifications to dynamically defined object attributes. Exploitation of this vulnerability may allow a remote attacker to modify data...
CVE-2026-118581
A flaw was found in the MongoDB Java Driver. The BSON Binary JSON encoding component fails to verify that an externally supplied raw document's declared length matches its actual byte range before copying it into an outgoing database command. A remote attacker can exploit this flaw by submitting...
K000163738: SFTP vulnerability CVE-2026-59995
Security Advisory Description sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server. CVE-2026-59995 Impact This vulnerability allows a remote attacker-controlled server to cause a partial deni...
Use of GET Request Method With Sensitive Query Strings
Overview apostrophe is a content management system CMS for Node.js. It supports in-context editing, schema-driven content types, flexible widgets and a great deal more. This module contains everything necessary to build a website with ApostropheCMS. Affected versions of this package are vulnerabl...
Use of GET Request Method With Sensitive Query Strings
Overview @apostrophecms/passport-bridge is a Passport.js authentication for Apostrophe Affected versions of this package are vulnerable to Use of GET Request Method With Sensitive Query Strings via an unspecified vector in the package, allowing an authenticated attacker with low privileges to rea...
Directory Traversal
Overview uploadfs is a Store files in a web-accessible location via a simplified API. Can automatically scale and rotate images. Includes S3, Azure and local filesystem-based backends with the most convenient features of each. Affected versions of this package are vulnerable to Directory Traversa...
CVE-2026-111634 Helical Insight through 7.0.0 SQL Injection via /executeDatasource
Helical Insight through 7.0.0 contains an sql injection vulnerability that allows authenticated viewers to inject SQL through unescaped report parameter values sent to /executeDatasource. Attackers can supply crafted Numeric or String placeholder values that bypass the broken SqlDetect guard to...
CVE-2026-111634 Helical Insight through 7.0.0 SQL Injection via /executeDatasource
Helical Insight through 7.0.0 contains an sql injection vulnerability that allows authenticated viewers to inject SQL through unescaped report parameter values sent to /executeDatasource. Attackers can supply crafted Numeric or String placeholder values that bypass the broken SqlDetect guard to...
CVE-2026-111634
Helical Insight through version 7.0.0 is vulnerable to a SQL injection flaw located at the /executeDatasource endpoint. The root cause is the use of unescaped report parameter values which allows attackers to bypass the SqlDetect guard . Authenticated viewers can exploit this by supplying crafted...
CVE-2025-68403
An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an administrator account, they can then exploit the vulnerability to modify data on the system. We have already fixed the vulnerability in the following version:...
CVE-2025-68403
The QuRouter software is affected by an external control of system or configuration setting vulnerability (CWE-15). A local attacker who has obtained administrator privileges can exploit this flaw to modify data on the system. The vulnerability has been addressed in QuRouter version 2.7.2.113 and...
CVE-2025-68403 Inadequate Steps to Confirm Vulnerability in QuRouter
An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an administrator account, they can then exploit the vulnerability to modify data on the system. We have already fixed the vulnerability in the following version:...
CVE-2025-68403 Inadequate Steps to Confirm Vulnerability in QuRouter
An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an administrator account, they can then exploit the vulnerability to modify data on the system. We have already fixed the vulnerability in the following version:...
EUVD-2025-211095
An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an administrator account, they can then exploit the vulnerability to modify data on the system. We have already fixed the vulnerability in the following version:...
PT-2026-114807
An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an administrator account, they can then exploit the vulnerability to modify data on the system. We have already fixed the vulnerability in the following version:...
CVE-2025-68403: External Control of System or Configuration Setting
An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an administrator account, they can then exploit the vulnerability to modify data on the system. We have already fixed the vulnerability in the following version:...
CVE-2026-103946
Tenable Nessus versions prior to 10.12.5 are affected by an SQL injection vulnerability (CVE-2026-103946 ). This flaw could allow an authenticated user to read or modify data stored within the Nessus application. The issue has been resolved in version 10.12.5 . While the vulnerability is confirme...