CVE-2025-41280

Nozomi Networks Labs identified a CWE-23: Relative Path Traversal Zip Slip in Waterfall WF-500 RX Host in version 7.9.1.0 R2502171040 that allows attackers with access to the TX Host to execute code on the RX Host when a MySQL connector is configured and file compression is enabled...

CVE-2025-41280: Relative Path Traversal

Nozomi Networks Labs identified a CWE-23: Relative Path Traversal Zip Slip in Waterfall WF-500 RX Host in version 7.9.1.0 R2502171040 that allows attackers with access to the TX Host to execute code on the RX Host when a MySQL connector is configured and file compression is enabled...

PT-2026-44818

Name of the Vulnerable Software and Affected Versions Waterfall WF-500 RX Host version 7.9.1.0 R2502171040 Description A Relative Path Traversal Zip Slip issue exists, which occurs when an application fails to properly validate the filenames within a compressed archive, potentially allowing files...

Waterfall WF-500 security vulnerability

The Waterfall WF-500 is a sending-side host component in the industrial control network unidirectional security gateway developed by the Israeli company Waterfall. The Waterfall WF-500 has a security vulnerability that stems from relative path traversal. This vulnerability could allow attackers...

Waterfall WF-500: Operating System Command Injection Vulnerability

The Waterfall WF-500 is a sending-side host component in the industrial control network unidirectional security gateway developed by the Israeli company Waterfall. Version 7.9.1.0 R2502171040 of the Waterfall WF-500 RX Host contains an operating system command injection vulnerability. This...

PT-2026-44819

Name of the Vulnerable Software and Affected Versions Waterfall WF-500 RX Host version 7.9.1.0 R2502171040 Description An OS Command Injection issue exists when a MySQL connector is configured. This allows attackers with access to the TX Host to execute arbitrary code on the RX Host due to improp...

CVE-2025-41281: Improper Neutralization of Special Elements used in an OS Command

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' in Waterfall WF-500 RX Host in version 7.9.1.0 R2502171040 that allows attackers with access to the TX Host to execute code on the RX Host when a MySQL connector is...

CVE-2026-44635

Kysely is a type-safe TypeScript SQL query builder. From 0.26.0 to 0.28.16, DefaultQueryCompiler.visitJSONPathLeg does not escape JSON-path metacharacters ., , , , , ?. When attacker-controlled input flows into eb.refcol, '-$'.keyinput or .atinput — including type-safe code where the JSON column ...

CVE-2026-44521 elFinder: SQL Injection MySQL Volume Driver (elFinderVolumeMySQL)

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.68, an authenticated SQL injection vulnerability in the elFinder MySQL volume driver elFinderVolumeMySQL allows any logged-in user, including users with read-only access to the affected volume, to...

CVE-2026-44521 elFinder: SQL Injection MySQL Volume Driver (elFinderVolumeMySQL)

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.68, an authenticated SQL injection vulnerability in the elFinder MySQL volume driver elFinderVolumeMySQL allows any logged-in user, including users with read-only access to the affected volume, to...

CVE-2026-44521

elFinder contains an authenticated SQL injection in the MySQL volume driver (elFinderVolumeMySQL). A logged-in user, including those with read-only access, can inject SQL via a crafted target file hash, potentially leading to unauthorized data disclosure and denial of service. Affected installati...

WS-2018-0023

In Propel2 versions 2.0.0-alpha1 before 2.0.0-alpha8 when constructing a MySQL LIMIT clause, values for the offset and limit are coerced to integers. This prevents arbitrary SQL from being injected via a query limit...

WS-2018-0080

"Versions of mysql before 2.14.0 are vulnerable to remove memory exposure.Affected versions of mysql package allocate and send an uninitialized memory over the network when a number is provided as a password."...

@aliens-lyon.fr/ep_mypads (1.7.24), @buzuli/all (>=1.0.0, <=1.1.0) +748 more potentially affected by unknown CVE via mysql (>=2.0.0-alpha8, <=2.13.0)

mysql NPM version =2.0.0-alpha8, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =0.1.0, =1.0.0, =0.0.3, =0.0.2, =0.0.6 and more Source cves: unknown CVE Source advisory: MEND:WS-2018-0080...

WS-2018-0059

SQL Injection in TYPO3 6.2.x before 6.2.18. A flaw in the database escaping API results in a SQL injection vulnerability when extension dbal is enabled and configured for MySQL passthrough mode in its extension configuration. All queries which use the DatabaseConnection::sqlquery are vulnerable,...

WS-2018-0024

In Propel through version 1.7.1 when constructing a MySQL LIMIT clause, values for the offset and limit are coerced to integers. This prevents arbitrary SQL from being injected via a query limit...

@aliens-lyon.fr/ep_mypads (1.7.24), @buzuli/all (>=1.0.0, <=1.1.0) +869 more potentially affected by unknown CVE via mysql (>=0.9.2, <=2.13.0)

mysql NPM version =0.9.2, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.2, =4.49.0, =1.0.0, =3.2.1 and more Source cves: unknown CVE Source advisory: MEND:WS-2017-0280...

WS-2017-0280

Affected versions of the mysql package before 2.14.0, are vulnerable to Uninitialized Memory Exposure due to wrong initialization of the Buffer...

RHSA-2026:20693 Red Hat Security Advisory: mysql8.4 security update

Bulletin has no description...

CVE-2026-44635: Improper Limitation of a Pathname to a Restricted Directory

Kysely is a type-safe TypeScript SQL query builder. From 0.26.0 to 0.28.16, DefaultQueryCompiler.visitJSONPathLeg does not escape JSON-path metacharacters ., , , , , ?. When attacker-controlled input flows into eb.refcol, '-$'.keyinput or .atinput — including type-safe code where the JSON column ...