CVE-2025-11253 SQLi in Aksis Technologies' Netty ERP

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Aksis Technology Inc. Netty ERP allows SQL Injection. This issue affects Netty ERP: before V.1.1000...

EUVD-2025-35805

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Aksis Technology Inc. Netty ERP allows SQL Injection.This issue affects Netty ERP: before V.1.1000...

CVE-2025-11253 SQLi in Aksis Technologies' Netty ERP

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Aksis Technology Inc. Netty ERP allows SQL Injection. This issue affects Netty ERP: before V.1.1000...

Aksis Netty ERP SQL注入漏洞

Aksis Netty ERP is an enterprise resource planning software from Aksis Turkey. An SQL injection vulnerability exists in Aksis Netty ERP versions prior to V.1.1000, which stems from improper neutralization of special elements and can lead to SQL injection attacks...

PT-2025-43604

Name of the Vulnerable Software and Affected Versions Aksis Technology Inc. Netty ERP versions prior to V.1.1000 Description Netty ERP contains a flaw due to improper neutralization of special elements used in an SQL command, leading to a SQL Injection issue. This allows for the potential executi...

OPENSUSE-SU-2025:15667-1 netty-4.1.128-1.1 on GA media

These are all security issues fixed in the netty-4.1.128-1.1 package on the GA media of openSUSE Tumbleweed...

netty-codec: netty-codec-compression: Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack

A flaw was found in Netty. With specially crafted input, BrotliDecoder and some other decompressing decoders will allocate a large number of reachable byte buffers, which can lead to denial of service...

Security Bulletin: Security Vulnerabilities in Java libraries affect IBM Voice Gateway

Summary Multiple vulnerabilities were addressed in IBM Voice Gateway Vulnerability Details CVEID:CVE-2025-58057 DESCRIPTION: Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In...

Security Bulletin: Due to use of netty-codec, IBM Sterling Connect:Direct Web Services is affected by denial of service.

Summary Netty-codec is used by IBM Sterling Connect:Direct Web Services CVE-2025-58057. Vulnerability Details CVEID:CVE-2025-58057 DESCRIPTION: Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In...

SUSE CVE-2025-59419

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.128.Final and 4.2.7.Final, the SMTP codec in Netty contains an SMTP command injection vulnerability due to insufficient input validation for Carriage Return \r and Line Feed \n characters in user-suppli...

Netty has SMTP Command Injection Vulnerability that Allows Email Forgery

Summary An SMTP Command Injection CRLF Injection vulnerability in Netty's SMTP codec allows a remote attacker who can control SMTP command parameters e.g., an email recipient to forge arbitrary emails from the trusted server. This bypasses standard email authentication and can be used to...

GHSA-JQ43-27X9-3V86 Netty has SMTP Command Injection Vulnerability that Allows Email Forgery

Summary An SMTP Command Injection CRLF Injection vulnerability in Netty's SMTP codec allows a remote attacker who can control SMTP command parameters e.g., an email recipient to forge arbitrary emails from the trusted server. This bypasses standard email authentication and can be used to...

ai.spice:spiceai (=0.6.0), cn.hserver:hserver (=3.7.0) +529 more potentially affected by CVE-2025-59419 via io.netty:netty-codec-smtp (>=4.2.0.Alpha1 <=4.2.6.Final)

io.netty:netty-codec-smtp MAVEN version =4.2.0.Alpha1, =4.2.6.Final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty-codec-smtp and may be impacted: - ai.spice:spiceai =0.6.0 - cn.hserver:hserver =3.7.0 - cn.hserver:hserver-netty-web...

EUVD-2025-34685

Netty has SMTP Command Injection Vulnerability that Allows Email Forgery...

ai.chronon:service_2.11 (>=0.0.86 <=def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91), ai.chronon:service_2.12 (>=0.0.86 <=def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91) +2230 more potentially affected by CVE-2025-59419 via io.netty:netty-codec-smtp (>=4.1.100.Final <=4.1.127.Final)

io.netty:netty-codec-smtp MAVEN version =4.1.100.Final, =0.0.86, =0.0.86, =0.0.86, =0.0.1, =2.0.24, =1.1.9, =0.0.1, =0.3.36, =1.9.0, =2.0.0, =2.4.0, =2.4.0, =0.0.15, =4.0.0, =5.0.2 and more Source cves: CVE-2025-59419 Source advisory: OSV:GHSA-JQ43-27X9-3V86...

CRLF Injection

Overview Affected versions of this package are vulnerable to CRLF Injection via insufficient input validation in the DefaultSmtpRequest process. An attacker can inject arbitrary SMTP commands by supplying malicious parameters containing CRLF sequences, allowing the sending of forged emails that...

ai.chronon:service_2.11 (>=0.0.86 <=def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91), ai.chronon:service_2.12 (>=0.0.86 <=def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91) +2230 more potentially affected by CVE-2025-59419 via io.netty:netty-codec-smtp (>=4.1.100.Final <=4.1.127.Final)

io.netty:netty-codec-smtp MAVEN version =4.1.100.Final, =0.0.86, =0.0.86, =0.0.86, =0.0.1, =2.0.24, =1.1.9, =0.0.1, =0.3.36, =1.9.0, =2.0.0, =2.4.0, =2.4.0, =0.0.15, =4.0.0, =5.0.2 and more Source cves: CVE-2025-59419 Source advisory: SNYK:JAVA-IONETTY-13560334...

ai.spice:spiceai (=0.6.0), cn.hserver:hserver (=3.7.0) +529 more potentially affected by CVE-2025-59419 via io.netty:netty-codec-smtp (>=4.2.0.Alpha1 <=4.2.6.Final)

io.netty:netty-codec-smtp MAVEN version =4.2.0.Alpha1, =4.2.6.Final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty-codec-smtp and may be impacted: - ai.spice:spiceai =0.6.0 - cn.hserver:hserver =3.7.0 - cn.hserver:hserver-netty-web...

CVE-2025-59419

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.128.Final and 4.2.7.Final, the SMTP codec in Netty contains an SMTP command injection vulnerability due to insufficient input validation for Carriage Return \r and Line Feed \n characters in user-suppli...

DEBIAN-CVE-2025-59419

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.128.Final and 4.2.7.Final, the SMTP codec in Netty contains an SMTP command injection vulnerability due to insufficient input validation for Carriage Return \r and Line Feed \n characters in user-suppli...