Intranda goobi-viewer-core SQL injection vulnerability

A security vulnerability exists in Intranda Goobi Viewer Core versions from 22.04 up to and including 26.05. This vulnerability arises because the unauthenticated REST endpoint GET /api/v1/index/solrField/spatial/search directly concatenates user-supplied region query parameters into the Solr que...

Super Store Finder 3.8 SQL Injection

Super Store Finder version 3.8 suffers from multiple remote SQL injection vulnerabilities. Exploit Title: Super Store Finder 3.8 - Multiple SQL Injection Exploit Author: CraCkEr Date: 26/08/2026 Vendor: highwarden Vendor Homepage: https://codecanyon.net/item/super-store-finder/3630922 Software...

ServiceNow AI Platform Multiple Vulnerabilities (August 2026 CVE Advisory)

The version of the ServiceNow AI Platform Now Platform running on the remote host is missing the remediations described in the August 2026 CVE Advisory Notification. It is, therefore, affected by multiple vulnerabilities, including the following: - A sandbox escape vulnerability that could allow ...

Cacti SQL injection vulnerability

Versions 1.2.27 through 1.2.31 of Cacti contain an SQL injection vulnerability. This vulnerability stems from an authenticated stored second-stage SQL injection within the automated tree rule item handler. Users with Automation privileges can persist arbitrary SQL fragments into the...

WordPress GamiPress SQL injection vulnerability

WordPress GamiPress versions 8.0.7 and earlier contain an SQL injection vulnerability. This vulnerability stems from improper handling of special elements within SQL commands, potentially leading to blind SQL injection...

Anuko Time Tracker 1.20.0.5640 SQL Injection

Anuko Time Tracker versions prior to 1.20.0.5642 contain an authenticated SQL injection vulnerability in the Puncher plugin. A proof of concept is provided to inject a scalar SQL query through the date parameter and read its result. https://packetstorm.news/download/237259...

CVE-2026-79858

An unauthenticated SQL injection vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation could allow an unauthenticated remote attacker to obtain and modify sensitive information in the underlying database and to interrupt the normal operation of the affected service...

CVE-2026-79852

A vulnerability in the web-based management interface of AOS could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...

CVE-2026-79849

Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...

CVE-2026-79854

A vulnerability in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS-10 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...

CVE-2026-79848

Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...

CVE-2026-79858 Unauthenticated SQL Injection Vulnerability in the PAPI Protocol of AOS-8

An unauthenticated SQL injection vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation could allow an unauthenticated remote attacker to obtain and modify sensitive information in the underlying database and to interrupt the normal operation of the affected service...

CVE-2026-79858 Unauthenticated SQL Injection Vulnerability in the PAPI Protocol of AOS-8

An unauthenticated SQL injection vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation could allow an unauthenticated remote attacker to obtain and modify sensitive information in the underlying database and to interrupt the normal operation of the affected service...

CVE-2026-79858

CVE-2026-79858 involves an unauthenticated SQL Injection vulnerability in the PAPI Protocol of AOS-8 . While the documents do not provide specific technical details regarding the root cause or impact, the associated metrics indicate a CRITICAL severity score of 9.8. Specific exploit details and r...

CVE-2026-79854 Unauthenticated SQL Injection Vulnerability leads to Remote Code Execution in AOS-10

A vulnerability in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS-10 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...

CVE-2026-79854 Unauthenticated SQL Injection Vulnerability leads to Remote Code Execution in AOS-10

A vulnerability in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS-10 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...

CVE-2026-79854

A vulnerability exists in AOS-10 where an unauthenticated SQL Injection flaw can lead to Remote Code Execution . While specific software versions or root cause details are not provided in the documents, the vulnerability is categorized as CRITICAL with a CVSSv3.1 score of 9.8. Exploitation detail...

Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks

Attackers are exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator VCO, the central management system for VeloCloud SD-WAN networks, the company said in an advisory on October 22. The flaw lets anyone who can log in to the orchestrator, even with a read-only customer accoun...

CVE-2026-79852 Unauthenticated SQL Injection allows Remote Code Execution in AOS Web-Based Management Interface

A vulnerability in the web-based management interface of AOS could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...

CVE-2026-79852

CVE-2026-79852 involves an unauthenticated SQL Injection vulnerability within the AOS Web-Based Management Interface . This security flaw can lead to Remote Code Execution (RCE) by an attacker. While the provided documents confirm the vulnerability type and potential impact, specific software ver...