146 matches found
CVE-2023-38891
CVE-2023-38891 Authenticated SQL Injection Vulnerability in VTiger Open Source CRM v7.5 Discovered by: Jacob Elliott 07/13/23 Summary In the Reports module in VTiger CRM v7.5.0, there is insufficient checking of the selected fields for the report which are stored and then later reintroduced as a...
CVE-2026-18912
ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticated technician to execute arbitrary SQL queries through the Reports module...
EUVD-2026-82656
ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticated technician to execute arbitrary SQL queries through the Reports module...
CVE-2026-18912
ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticated technician to execute arbitrary SQL queries through the Reports module...
CVE-2026-18912
ManageEngine DataSecurity Plus versions prior to 6310 are affected by an authenticated SQL injection vulnerability in the Reports module . An attacker with technician-level credentials can execute arbitrary SQL queries, leading to high confidentiality impact (data exfiltration) with a changed sco...
CVE-2026-18912
ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticated technician to execute arbitrary SQL queries through the Reports module...
CVE-2026-18912: Improper Neutralization of Special Elements used in an SQL Command
ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticated technician to execute arbitrary SQL queries through the Reports module...
PT-2026-95230
Name of the Vulnerable Software and Affected Versions ManageEngine DataSecurity Plus versions prior to 6310 Description An authenticated technician can execute arbitrary SQL queries through the Reports module. This is caused by a SQL injection, which occurs when untrusted data is inserted into a...
CVE-2026-70369
Koha's reports/acquisitionsstats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled Filter request parameters directly into WHERE fragments covering aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.homebranch, items.ccode,...
CVE-2026-70371
Koha's reports/issuesavgstats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Line and Column parameters are not validated against any whitelist and land verbatim in identifier positions SELECT DISTINCTROW, GRO...
CVE-2026-70370
Koha's reports/cataloguestats.pl builds dynamic SQL in sub calculate by interpolating the user-controlled Line and Column request parameters directly into identifier positions of the query SELECT DISTINCTROW, GROUP BY, ORDER BY with no whitelist validation...
CVE-2026-70373 Koha - SQL Injection in reports/issues_stats.pl
Koha's reports/issuesstats.pl the circulation statistics report builds its calculation query in sub calculate by concatenating several user-controlled request parameters directly into the SQL string. The PeriodTypeSel, PeriodDaySel, and PeriodMonthSel parameters are interpolated raw into...
CVE-2026-70373 Koha - SQL Injection in reports/issues_stats.pl
Koha's reports/issuesstats.pl the circulation statistics report builds its calculation query in sub calculate by concatenating several user-controlled request parameters directly into the SQL string. The PeriodTypeSel, PeriodDaySel, and PeriodMonthSel parameters are interpolated raw into...
CVE-2026-70373
Koha: SQL Injection in reports/issues_stats.pl. The circulation statistics report builds the calculation query by concatenating user-controlled request parameters into SQL, with PeriodTypeSel, PeriodDaySel, PeriodMonthSel, and other identifiers interpolated without whitelist or parameter binding....
CVE-2026-70372 Koha - SQL Injection in reports/bor_issues_top.pl
Koha's reports/borissuestop.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha databa...
CVE-2026-70372 Koha - SQL Injection in reports/bor_issues_top.pl
Koha's reports/borissuestop.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha databa...
CVE-2026-70372
Koha's reports/borissuestop.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Criteria parameter is only normalized by a table-name prefix and is never whitelisted, landing verbatim in identifier positions SELECT...
EUVD-2026-52674
Koha's reports/borissuestop.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Criteria parameter is only normalized by a table-name prefix and is never whitelisted, landing verbatim in identifier positions SELECT...
CVE-2026-70371 Koha - SQL Injection in reports/issues_avg_stats.pl
Koha's reports/issuesavgstats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Line and Column parameters are not validated against any whitelist and land verbatim in identifier positions SELECT DISTINCTROW, GRO...
EUVD-2026-52673
Koha's reports/issuesavgstats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Line and Column parameters are not validated against any whitelist and land verbatim in identifier positions SELECT DISTINCTROW, GRO...