CVE-2024-23815

A vulnerability has been identified in Desigo CC All versions if access from Installed Clients to Desigo CC server is allowed from networks outside of a highly protected zone, Desigo CC All versions if access from Installed Clients to Desigo CC server is only allowed within highly protected zones...

CVE-2024-23815

The CVE-2024-23815 entry concerns Siemens Desigo CC. Affected: Desigo CC server (all versions) where Installed Clients can reach the server from networks outside a highly protected zone, or only within highly protected zones. Issue: the server fails to authenticate certain client requests, allowi...

ROS-20250505-05

The vulnerability of the Zabbix universal monitoring system is related to insufficient cleansing of user data passed via the "groupBy" parameter in include/classes/api/CApiService.php. Exploitation of the vulnerability could allow a remote attacker to execute arbitrary SQL queries in the database...

The vulnerability of the GetActiveConnectionVariables method in the software for managing and monitoring remote objects in telemetry and telemechanics systems allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the GetActiveConnectionVariables method in software for managing and monitoring remote objects in telemetry and telemechanics systems is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to compromis...

The vulnerability of the LockSmtpSettings method in the software for managing and monitoring remote devices in telemetry and telemechanics systems allows a perpetrator to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the LockSmtpSettings method in the software for managing and monitoring remote devices in telemetry and telemechanics systems is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to compromise the...

WordPress plugin Frontend Dashboard SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection...

SAP NetWeaver Buffer Overflow Vulnerability

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. SAP NetWeaver suffers from a buffer overflow vulnerability that stems from improper handling of memory addresses, which could allow an attacker to execute certain forms of SQL queries. An attack...

CVE-2025-3470

The TS Poll – Survey, Versus Poll, Image Poll, Video Poll plugin for WordPress is vulnerable to SQL Injection via the s parameter in all versions up to, and including, 2.4.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...

CVE-2025-30015

Due to incorrect memory address handling in ABAP SQL of SAP NetWeaver and ABAP Platform Application Server ABAP, an authenticated attacker with high privileges could execute certain forms of SQL queries leading to manipulation of content in the output variable. This vulnerability has a low impact...

CVE-2025-30015 Memory Corruption vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP)

Due to incorrect memory address handling in ABAP SQL of SAP NetWeaver and ABAP Platform Application Server ABAP, an authenticated attacker with high privileges could execute certain forms of SQL queries leading to manipulation of content in the output variable. This vulnerability has a low impact...

CVE-2025-30015

CVE-2025-30015 affects SAP NetWeaver and ABAP Platform (Application Server ABAP). The issue stems from incorrect memory address handling in ABAP SQL, enabling an authenticated attacker with high privileges to execute certain SQL queries and manipulate content in the output variable. The reported ...

PT-2025-15373 · Sap · Sap Netweaver +1

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver and ABAP Platform Application Server ABAP affected versions not specified Description: The issue arises from incorrect memory address handling in ABAP SQL, allowing an authenticated attacker with high privileges to execute...

The vulnerability of the qi_inst_state_free component in the Virtuoso-OpenSource web application development platform allows a attacker to trigger a service failure.

The vulnerability of the qiinststatefree component in the Virtuoso-OpenSource web application development platform is related to improper elimination of special elements used in SQL commands. Exploiting this vulnerability can allow an attacker to cause service interruptions by sending specially...

The vulnerability of the itc_hash_compare component in the Virtuoso-OpenSource web application development platform allows a attacker to trigger a service failure.

The vulnerability of the itchashcompare component in the Virtuoso-opensource web application development platform is related to the improper elimination of special elements used in SQL commands. Exploiting this vulnerability can allow an attacker to cause a service failure by sending specially...

The vulnerability of the qi_inst_state_free component in the Virtuoso-OpenSource web application development platform allows a attacker to trigger a service failure.

The vulnerability of the qiinststatefree component in the Virtuoso-OpenSource web application development platform is related to improper elimination of special elements used in SQL commands. Exploiting this vulnerability can allow an attacker to cause service interruptions by sending specially...

The vulnerability of the sqlg_hash_source component in the Virtuoso-OpenSource web application development platform allows a attacker to trigger a service failure.

The vulnerability of the sqlghashsource component in the Virtuoso-opensource web application development platform is related to the distribution of resources without any restrictions or regulations. Exploiting this vulnerability allows a malicious actor to cause service interruptions by sending...

The vulnerability of the `box_deserialize_string` component in the Virtuoso-OpenSource web application development platform allows a attacker to trigger a service failure.

The vulnerability of the boxdeserializestring component in the Virtuoso-OpenSource web application development platform is related to improper elimination of special elements used in SQL commands. Exploiting this vulnerability can allow an attacker to cause a service failure by sending specially...

The vulnerability of the chash_array component in the virtuoso-opensource web application development platform allows a hacker to trigger a service failure.

The vulnerability of the chasharray component in the virtuoso-opensource web application development platform is related to improper elimination of special elements used in SQL commands. Exploiting this vulnerability can allow an attacker to cause a service failure by sending specially crafted SQ...

GHSA-7GJ6-22M4-QFHX DB-GPT Arbitrary File Write vulnerability

In eosphoros-ai/db-gpt version v0.6.3 and earlier, the web API POST /api/v1/editor/chart/run allows execution of arbitrary SQL queries without any access control. This vulnerability can be exploited by attackers to perform Arbitrary File Write, enabling them to write arbitrary files to the victim...

CVE-2024-11958

CVE-2024-11958 affects the duckdb_retriever component in run-llama/llama_index, with SQL queries constructed without prepared statements. This enables SQL injection and can lead to remote code execution (RCE) by installing the shellfs extension and executing commands. Public references (GHSA-339R...