CVE-2025-13294 Unauthenticated SQL Injection

An unauthenticated SQL injection vulnerability exists in the web server of TBEA TLogger V2.1.0.0B0.0.0.0. Multiple HTTP endpoints incorporate attacker-controlled parameters directly into SQLite queries without sufficient validation or parameterization. A remote unauthenticated attacker can exploi...

CVE-2025-13294

An unauthenticated SQL injection vulnerability exists in the web server of TBEA TLogger V2.1.0.0B0.0.0.0. Multiple HTTP endpoints incorporate attacker-controlled parameters directly into SQLite queries without sufficient validation or parameterization. A remote unauthenticated attacker can exploi...

EUVD-2025-210667

An unauthenticated SQL injection vulnerability exists in the web server of TBEA TLogger V2.1.0.0B0.0.0.0. Multiple HTTP endpoints incorporate attacker-controlled parameters directly into SQLite queries without sufficient validation or parameterization. A remote unauthenticated attacker can exploi...

CVE-2025-13294

Affected software: TBEA TLogger web server (firmware version V2.1.0.0B0.0.0.0). Vulnerability: Unauthenticated SQL injection in multiple HTTP endpoints that incorporate attacker-controlled parameters directly into SQLite queries. Impact: attacker can read, modify, or delete data in CCU.db; high c...

CVE-2026-72899

Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter dimension parameter...

CVE-2026-72898

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/resetpassword' database endpoint and gain administrator access to the connected Metabase instance...

CVE-2026-72899 Metabase SQL injection via public card or dashboard

Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter dimension parameter...

EUVD-2026-55691

Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter dimension parameter...

CVE-2026-72899

Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter dimension parameter...

CVE-2026-72899

Metabase is affected by CVE-2026-72899: an unauthenticated SQL injection via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter. The flaw enables arbitrary SQL injection through the field-filter input; exploitation details are not provided beyond access to a pub...

CVE-2026-72898

Metabase is affected by CVE-2026-72898: an unauthenticated attacker can inject arbitrary SQL through the /reset_password endpoint, forging an administrator session and gaining full access to the Metabase instance. The root cause, as described in PoC materials, is that the password-reset API accep...

EUVD-2026-55690

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/resetpassword' database endpoint and gain administrator access to the connected Metabase instance...

CVE-2026-72898 Metabase SQL injection via password reset endpoint

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/resetpassword' database endpoint and gain administrator access to the connected Metabase instance...

CVE-2026-72898

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/resetpassword' database endpoint and gain administrator access to the connected Metabase instance...

CVE-2026-72898 Metabase SQL injection via password reset endpoint

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/resetpassword' database endpoint and gain administrator access to the connected Metabase instance...

EUVD-2026-55671

Discourse is an open-source discussion platform. From 2026.1.0-latest until 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, anyone able to run a parameterized Data Explorer query, including non-staff members of a group a query is shared with, could craft parameter values that escaped the...

CVE-2026-72731

Discourse is an open-source discussion platform. From 2026.1.0-latest until 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, anyone able to run a parameterized Data Explorer query, including non-staff members of a group a query is shared with, could craft parameter values that escaped the...

CVE-2026-72731 Discourse: Strip SQL comments and use non-recursive parameter interpolation in Data Explorer

Discourse is an open-source discussion platform. From 2026.1.0-latest until 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, anyone able to run a parameterized Data Explorer query, including non-staff members of a group a query is shared with, could craft parameter values that escaped the...

CVE-2026-72731

Discourse vulnerability CVE-2026-72731 affects 2026.1.0-latest through 2026.8.0-latest.1, including the Data Explorer query path and plugin data_explorer code, where parameterized Data Explorer queries could be crafted to escape the intended query via non-recursive and recursive parameter interpo...

CVE-2026-63106

ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product listing API where the rating parameter from the products endpoint is concatenated directly into a MySQL HAVING clause without parameterization in ProductController.php. Attackers can perform...