EUVD-2025-16925

Malicious code in bioql PyPI...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the QuerySubscribers function. An attacker can escalate privileges by injecting malicious SQL commands. Remediation Upgrade github.com/knadh/listmonk/internal/core to version 5.0.0 or higher. References - GitHub Commit...

CVE-2025-46011: Improper Neutralization of Special Elements used in an SQL Command

Listmonk v4.1.0 fixed in v5.0.0 is vulnerable to SQL Injection in the QuerySubscribers function which allows attackers to escalate privileges...

PT-2025-23854

Name of the Vulnerable Software and Affected Versions Listmonk versions 2.4.0 through 4.1.0 Description The issue allows attackers to escalate privileges through SQL Injection in the QuerySubscribers function. Recommendations For versions 2.4.0 through 4.1.0, consider disabling the QuerySubscribe...