CVE-2025-30015

CVE-2025-30015 affects SAP NetWeaver and ABAP Platform (Application Server ABAP). The issue stems from incorrect memory address handling in ABAP SQL, enabling an authenticated attacker with high privileges to execute certain SQL queries and manipulate content in the output variable. The reported ...

PT-2025-15373 · Sap · Sap Netweaver +1

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver and ABAP Platform Application Server ABAP affected versions not specified Description: The issue arises from incorrect memory address handling in ABAP SQL, allowing an authenticated attacker with high privileges to execute...

Virtuoso-OpenSource itc_hash_compare DoS

The vulnerability of the itchashcompare component in the Virtuoso-opensource web application development platform is related to the improper elimination of special elements used in SQL commands. Exploiting this vulnerability can allow an attacker to cause a service failure by sending specially...

Virtuoso-OpenSource DoS

The vulnerability of the qiinststatefree component in the Virtuoso-OpenSource web application development platform is related to improper elimination of special elements used in SQL commands. Exploiting this vulnerability can allow an attacker to cause service interruptions by sending specially...

Virtuoso-OpenSource DoS

The vulnerability of the qiinststatefree component in the Virtuoso-OpenSource web application development platform is related to improper elimination of special elements used in SQL commands. Exploiting this vulnerability can allow an attacker to cause service interruptions by sending specially...

Virtuoso-OpenSource sqlg_hash_source DoS

The vulnerability of the sqlghashsource component in the Virtuoso-opensource web application development platform is related to the distribution of resources without any restrictions or regulations. Exploiting this vulnerability allows a malicious actor to cause service interruptions by sending...

virtuoso-opensource chash_array DoS

The vulnerability of the chasharray component in the virtuoso-opensource web application development platform is related to improper elimination of special elements used in SQL commands. Exploiting this vulnerability can allow an attacker to cause a service failure by sending specially crafted SQ...

Virtuoso-OpenSource box_deserialize_string DoS

The vulnerability of the boxdeserializestring component in the Virtuoso-OpenSource web application development platform is related to improper elimination of special elements used in SQL commands. Exploiting this vulnerability can allow an attacker to cause a service failure by sending specially...

GHSA-7GJ6-22M4-QFHX DB-GPT Arbitrary File Write vulnerability

In eosphoros-ai/db-gpt version v0.6.3 and earlier, the web API POST /api/v1/editor/chart/run allows execution of arbitrary SQL queries without any access control. This vulnerability can be exploited by attackers to perform Arbitrary File Write, enabling them to write arbitrary files to the victim...

CVE-2024-11958

CVE-2024-11958 affects the duckdb_retriever component in run-llama/llama_index, with SQL queries constructed without prepared statements. This enables SQL injection and can lead to remote code execution (RCE) by installing the shellfs extension and executing commands. Public references (GHSA-339R...

CVE-2024-8099 Server-Side Request Forgery (SSRF) in vanna-ai/vanna

A Server-Side Request Forgery SSRF vulnerability exists in the latest version of vanna-ai/vanna when using DuckDB as the database. An attacker can exploit this vulnerability by submitting crafted SQL queries that leverage DuckDB's default features, such as readcsv, readcsvauto, readtext, and...

CVE-2024-10901

In eosphoros-ai/db-gpt version v0.6.0, the web API "POST /api/v1/editor/chart/run" allows execution of arbitrary SQL queries without any access control. This vulnerability can be exploited by attackers to perform Arbitrary File Write, enabling them to write arbitrary files to the victim's file...

PT-2025-12219

Name of the Vulnerable Software and Affected Versions vanna-ai/vanna affected versions not specified Description A Server-Side Request Forgery SSRF issue exists when using DuckDB as the database, allowing attackers to submit crafted SQL queries to make unauthorized requests to internal or externa...

WordPress plugin Eventer has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2025-9675

Name of the Vulnerable Software and Affected Versions Uniguest Tripleplay versions prior to 24.2.1 Description The issue is an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries on the backend database. Recommendations For versions prior to...

CVE-2024-50706

Unauthenticated SQL injection vulnerability in Uniguest Tripleplay version 23.1+ allows remote attackers to execute arbitrary SQL queries on the backend database...

CVE-2024-50706

An unauthenticated SQL injection vulnerability exists in Uniguest Tripleplay (versions prior to 24.2.1 , including 23.1+ ). This flaw allows remote attackers to execute arbitrary SQL queries on the backend database. To remediate this issue, users should update to version 24.2.1 or later. Exploita...

VERM_AJAX_functions.php Code Execution

The vulnerability of the VERMAJAXfunctions.php software for the Vicidial call processing center is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

CVE-2025-27133: Improper Neutralization of Special Elements used in an SQL Command

WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was discovered in the WeGIA application prior to version 3.2.15 at the adicionartipoexame.php endpoint. This vulnerability allows an authorized attacker to execute arbitrary SQL queries, allowing access to sensitive...

CVE-2025-26606

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, informacaoadicional.php endpoint. This vulnerability could allow an attacker to execute arbitrary SQL queries, allowing unauthoriz...