Selesta Visual Access Manager 安全漏洞

Selesta Visual Access Manager is a visual access manager from Selesta. Selesta Visual Access Manager suffers from a SQL injection vulnerability that stems from the lack of validation of externally entered SQL statements in /common/vamSql.php. An attacker can exploit this vulnerability to perform...

CVE-2023-42243

In Selesta Visual Access Manager 4.42.2, an authenticated user can access the administrative page /common/vamSql.php, which allows for arbitrary SQL queries...

CVE-2024-9188

Specially constructed queries cause cross platform scripting leaking administrator tokens...

CVE-2024-47518

Specially constructed queries targeting ETM could discover active remote access sessions...

CVE-2024-9188 Specially constructed queries cause cross platform scripting leaking administrator tokens

Specially constructed queries cause cross platform scripting leaking administrator tokens...

CVE-2024-47518 Specially constructed queries targeting ETM could discover active remote access sessions

Specially constructed queries targeting ETM could discover active remote access sessions...

CVE-2024-47518

CVE-2024-47518 details (connected doc): Arista NGFW/ETM (Edge Threat Management) is affected on versions 17.1.1 and prior by a vulnerability described as specially constructed queries that could discover active remote access sessions. Root cause is tied to ETM query handling that enables exposure...

CVE-2024-47518 Specially constructed queries targeting ETM could discover active remote access sessions

Specially constructed queries targeting ETM could discover active remote access sessions...

Malicious code in just-framework (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 95cb11d9c49d15c2a3d932930ab9d4f1567e118bf2ed951ab313856878f88859 Importing the module exfiltrates basic information using DNS queries. There is no other purpose of the package. --- Category: PROBABLYPENTEST - Packages lookin...

Malicious code in djangoframework-test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 fe24a0d1142970bffbb9b8eba926e7153c78c87083aa7e374c146d9e1608aec4 Importing the module exfiltrates basic information using DNS queries. There is no other purpose of the package. --- Category: PROBABLYPENTEST - Packages lookin...

PT-2025-2769

Name of the Vulnerable Software and Affected Versions: ETM affected versions not specified Description: Specially constructed queries targeting ETM could discover active remote access sessions. Recommendations: At the moment, there is no information about a newer version that contains a fix for...

PT-2025-3711

Name of the Vulnerable Software and Affected Versions Software affected versions not specified Description The issue involves specially constructed queries that cause cross-platform scripting, resulting in the leakage of administrator tokens. This allows for potential unauthorized access and...

PT-2025-1070 · Dell · Dell Powerscale Insightiq

Name of the Vulnerable Software and Affected Versions: Dell PowerScale InsightIQ affected versions not specified Description: The issue is related to a lack of protection for the SQL query structure in the Dell PowerScale InsightIQ software for performance monitoring and reporting. Exploitation o...

Drupal 安全漏洞

Drupal is an open source content management system developed in the PHP language by the Drupal community. A security vulnerability exists in Drupal RESTful Web Services versions 7.X-2.0 through 7.X-2.10, which stems from the inclusion of an Exposure of Sensitive Information via Data Queries...

WordPress plugin MDTF SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection...

The vulnerability of the query_to_xml_and_xmlschema/table_to_xml/table_to_xml_and_xmlschema function in the Apache Superset data visualization software allows a hacker to execute arbitrary SQL code.

The vulnerability of the querytoxmlandxmlschema/tabletoxml/tabletoxmlandxmlschema function exists due to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL code remotely...

CakePHP 4.5.9

CakePHP 4.5.9 The CakePHP core team is happy to announce the immediate availability of CakePHP 4.5.9. This is a maintenance release for the 4.5 branch that fixes a few community reported issues and a security fix. Bugfixes You can expect the following changes in 4.5.9. See the changelog for every...

SQL Injection

github.com/apache/trafficcontrol is vulnerable to SQL Injection. The vulnerability is due to improper input validation in Traffic Ops, allowing a privileged user with roles such as "admin," "federation," "operations," "portal," or "steering" to execute arbitrary SQL queries through...

[SECURITY] Fedora 41 Update: python-sql-1.5.2-3.fc41

python-sql is a library to write SQL queries in a pythonic way...

Vulnerability of the SMB microprogramming network device service on QNAP, allowing attackers to execute arbitrary code

The vulnerability of the SMB microprogramming network device software in QNAP is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...