1441 matches found
SQL injection in ADOdb PostgreSQL driver pg_insert_id() method
Improper escaping of a query parameter may allow an attacker to execute arbitrary SQL statements when the code using ADOdb connects to a PostgreSQL database and calls pginsertid with user-supplied data. Note that the indicated Severity corresponds to a worst-case usage scenario. Impact PostgreSQL...
SQL injection in ADOdb PostgreSQL driver pg_insert_id() method
Improper escaping of a query parameter may allow an attacker to execute arbitrary SQL statements when the code using ADOdb connects to a PostgreSQL database and calls pginsertid with user-supplied data. Note that the indicated Severity corresponds to a worst-case usage scenario...
Apereo CAS 安全漏洞
Apereo CAS is a web-based enterprise multilingual single sign-on solution from Apereo open source. A security vulnerability exists in Apereo CAS version 5.2.6, which stems from the file cas-5.2.6webapp-mgmtcas-management-webapp-...
BIT-RAILS-2024-41128 Action Dispatch has possible ReDoS vulnerability in query parameter filtering
Action Pack is a framework for handling and responding to web requests. Starting in version 3.1.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the query parameter filtering routines of Action Dispatch. Carefully crafted query parameters...
CVE-2025-31125 Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query
Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network using --host or server.host config option are affected. This vulnerability is fixed in 6.2.4, 6.1.3,...
CVE-2025-30365
WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was identified in versions prior to 3.2.8 in the endpoint /WeGIA/html/socio/sistema/controller/querygeracaoauto.php, specifically in the query parameter. This vulnerability allows the execution of arbitrary SQL...
CVE-2025-30352 Directus `search` query parameter allows enumeration of non permitted fields
Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0-alpha.4 and prior to version 11.5.0, the search query parameter allows users with access to a collection to filter items based on fields they do not have permission to view. This allows the...
CVE-2025-30352: Exposure of Sensitive Information to an Unauthorized Actor
Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0-alpha.4 and prior to version 11.5.0, the search query parameter allows users with access to a collection to filter items based on fields they do not have permission to view. This allows the...
CVE-2025-25301
Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the /api/remove endpoint takes a URL query parameter that allows an image to be fetched, processed and returned. An attacker may be able to query this endpoint to view pictures hosted on the internal network of the rembg...
PT-2025-9519
Name of the Vulnerable Software and Affected Versions Rembg versions 2.0.57 and earlier Description The issue allows an attacker to query the "/api/remove" endpoint to view pictures hosted on the internal network of the Rembg server, potentially leading to Information Disclosure. This is achieved...
The vulnerability of NETGEAR DGND2200 router microprogramming software, related to deficiencies in authentication procedures, allows attackers to circumvent existing security restrictions.
The vulnerability of NETGEAR DGND2200 router microprogramming software is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to circumvent existing security restrictions by adding the line “?x=1.gif” to the URL address...
PT-2025-9105 · Soteshop · Soteshop
Name of the Vulnerable Software and Affected Versions: Soteshop versions prior to 8.3.4 Description: A Cross-Site Scripting XSS issue exists, allowing remote attackers to execute arbitrary code via the query parameter in "/app-google-custom-search/searchResults". This can lead to the theft of...
CVE-2025-1776: Improper Neutralization of Input During Web Page Generation
Cross-Site Scripting XSS vulnerability in Soteshop, versions prior to 8.3.4, which could allow remote attackers to execute arbitrary code via the ‘query’ parameter in /app-google-custom-search/searchResults. This vulnerability can be exploited to steal sensitive user data, such as session cookies...
PT-2025-7059
Name of the Vulnerable Software and Affected Versions Audiobookshelf versions 2.17.0 through 2.19.0 Description A flaw in the authentication bypass logic allows unauthenticated requests to match certain unanchored regex patterns in the URL. Attackers can craft URLs containing substrings such as...
CVE-2024-32838: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in various API endpoints - offices, dashboards, etc. Apache Fineract versions 1.9 and before have a vulnerability that allows an authenticated attacker to inject malicious data into some of the REST API endpoints' query parameter. Users are recommended to upgrade to...
CVE-2024-57278: Improper Neutralization of Input During Web Page Generation
A reflected Cross-Site Scripting XSS vulnerability exists in /webscan/sqlmap/index.html in QingScan =v1.8.0. The vulnerability is caused by improper input sanitization of the query parameter, allowing an attacker to inject malicious JavaScript payloads. When a victim accesses a crafted URL...
CVE-2025-22992: Improper Neutralization of Special Elements used in an SQL Command
A SQL Injection vulnerability exists in the /feed/insert.json endpoint of the Emoncms project = 11.6.9. The vulnerability is caused by improper handling of user-supplied input in the data query parameter, allowing attackers to execute arbitrary SQL commands under specific conditions...
Emoncms 安全漏洞
Emoncms is an open source web application from Emoncms Open Source. The program is primarily used to process, record and display energy, temperature and other environmental data. A security vulnerability exists in Emoncms version 11.6.9 and earlier, which stems from improper handling of...
CVE-2024-9982
AIM LINE Marketing Platform from Esi Technology does not properly validate a specific query parameter. When the LINE Campaign Module is enabled, unauthenticated remote attackers can inject arbitrary FetchXml commands to read, modify, and delete database content...
