155 matches found
OESA-2021-1039 python-sqlalchemy security update
SQLAlchemy is an Object Relational Mapper ORM that provides a flexible, high-level interface to SQL databases. It contains a powerful mapping layer that users can choose to work as automatically or as manually, determining relationships based on foreign keys or to bridge the gap between database...
python-sqlalchemy: SQL Injection when the order_by parameter can be controlled
SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the orderby parameter...
python-sqlalchemy: SQL Injection when the order_by parameter can be controlled
SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the orderby parameter...
GHSA-887W-45RQ-VXGF SQLAlchemy vulnerable to SQL Injection via order_by parameter
SQLAlchemy before 1.3.0b3 allows SQL Injection via the orderby parameter. The fix commit 30307c4 was applied only to the main branch and was never backported to the 1.2.x release line; all 1.2.x versions remain vulnerable...
PYSEC-2019-123
SQLAlchemy before 1.3.0b3 allows SQL Injection via the orderby parameter. The fix commit 30307c4 was applied only to the main branch and was never backported to the 1.2.x release line; all 1.2.x versions remain vulnerable...
PYSEC-2019-53
SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the orderby parameter...
PYSEC-2019-123
SQLAlchemy before 1.3.0b3 allows SQL Injection via the orderby parameter. The fix commit 30307c4 was applied only to the main branch and was never backported to the 1.2.x release line; all 1.2.x versions remain vulnerable...
UBUNTU-CVE-2019-7164
SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the orderby parameter...
CVE-2018-3885
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The orderby parameter can be used to perform an SQL injection attack. An attacker can use a browser to trigger thes...
PT-2018-16278
Name of the Vulnerable Software and Affected Versions ERPNext version 10.1.6 Description An exploitable SQL injection issue exists in the authenticated part of the software. Specially crafted web requests can cause SQL injections, resulting in data compromise. The order by parameter can be used t...
Apache Fineract SQL Injection Vulnerability (CNVD-2018-09809)
Apache Fineract is a set of open source digital financial services platform of the U.S. Apache Apache Software Foundation. The platform can provide users with data management, loan and savings portfolio management and real-time financial data and other functions. An SQL injection vulnerability...
CVE-2017-17823
The Configuration component of Piwigo 2.9.2 is vulnerable to SQL Injection via the admin/configuration.php orderby array parameter. An attacker can exploit this to gain access to the data in a connected MySQL database...
iwebsns open source SNS system order_by parameter has a SQL injection vulnerability
iWebSNS is a large-scale high concurrency and high load of open source SNS software , based on iwebSuperInteraction iweb SI for short framework development . iwebsns open source SNS system orderby parameter has a SQL injection vulnerability . Attackers can use this vulnerability to obtain databas...
CVE-2017-7719
SQL injection in the Spider Event Calendar aka spider-event-calendar plugin before 1.5.52 for WordPress is exploitable with the orderby parameter to calendarfunctions.php or widgetThemefunctions.php, related to frontend/frontendfunctions.php...