282619 matches found
PT-2026-102632
Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary SQL through the Name parameter of the getEmpByname action without any authentication. Attackers can exploit UNION-based SQL injection...
VulnCheck KEV: CVE-2023-54400
Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary SQL through the Name parameter of the getEmpByname action without any authentication. Attackers can exploit UNION-based SQL injection...
VulnCheck KEV: CVE-2015-20122
Seeyon A6 collaborative office automation platform contains an unauthenticated SQL injection vulnerability in the attachids parameter of the file attachment download endpoint that allows remote attackers to extract arbitrary database contents without prior authentication. Attackers can inject...
CVE-2026-79536
The bytebase dbhub v1.2.0 software contains a SQL injection vulnerability within the /utils/sql-parser.ts component. An attacker can exploit this flaw by submitting a crafted SQL statement to gain unauthorized access to sensitive database information . No specific remediation steps or exploit det...
CVE-2026-63713: Improper Neutralization of Special Elements used in an SQL Command
The "search" parameter in the view audit logs feature within the utilities section is susceptible to a time-based blind SQL injection vulnerability...
CVE-2026-81930: Insufficiently Protected Credentials
Apache Airflow's Snowflake provider did not validate the connection's account and region fields before interpolating them into request URLs. The SQL API endpoint is built as https://account.snowflakecomputing.com/api/v2/statements, so an account value containing /, ? or demotes the intended domai...
PT-2026-102499
Apache Airflow's Snowflake provider did not validate the connection's account and region fields before interpolating them into request URLs. The SQL API endpoint is built as https://account.snowflakecomputing.com/api/v2/statements, so an account value containing /, ? or demotes the intended domai...
PT-2026-102712
Name of the Vulnerable Software and Affected Versions Mediawiki - UserPageViewTracker Extension versions prior to 1.46.1 Mediawiki - UserPageViewTracker Extension version 1.45.5 Mediawiki - UserPageViewTracker Extension version 1.43.10 Description An unauthenticated SQL Injection occurs due to...
PT-2026-102631
Seeyon A6 collaborative office automation platform contains an unauthenticated SQL injection vulnerability in the attach ids parameter of the file attachment download endpoint that allows remote attackers to extract arbitrary database contents without prior authentication. Attackers can inject...
CVE-2026-79536
bytebase dbhub v1.2.0 was discovered to contain a SQL injection vulnerability in the /utils/sql-parser.ts component. This vulnerability allows attackers to access sensitive databse information via a crafted SQL statement...
CVE-2026-86843: Improper Neutralization of Special Elements used in an SQL Command
The Apache Airflow Teradata provider's compute-cluster example Dag declared every one of its Dag Params as unconstrained free text and templated them straight into the compute-cluster operators, which interpolate those values into Teradata DDL. A user who is permitted to trigger that Dag - a...
PT-2026-102909
The "supplier no" parameter used in the business allocation search feature is vulnerable to time-based blind SQL injection...
Linux Distros Unpatched Vulnerability : CVE-2026-53629
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, an attacker with the READ right on logs can craft a URL for the...
The vulnerability of the Microsoft SQL Server Management Studio (SSMS) database management tool, related to the lack of measures taken to neutralize special elements, allows attackers to increase their privileges.
The vulnerability of the Microsoft SQL Server Management Studio SSMS management tool is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...
The vulnerability of the Adobe Connect instant messaging program, related to the lack of protective measures for the SQL query structure, allows attackers to execute arbitrary code.
The vulnerability of the Adobe Connect instant messaging program relates to the lack of security measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
PT-2026-102464
SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the id parameter...
PT-2026-102819
Name of the Vulnerable Software and Affected Versions bytebase dbhub version 1.2.0 Description An issue exists in the /utils/sql-parser.ts component that allows attackers to access sensitive database information by using a crafted SQL statement. This is a SQL injection, which occurs when an...
PT-2026-102628
ClipBucket v5 through 5.5.3-197 contains a time-based blind SQL injection vulnerability in the language update function where the language id parameter is concatenated unescaped into the WHERE clause of an UPDATE statement. An authenticated administrator with basic settings permission can inject...
CVE-2026-79536
bytebase dbhub v1.2.0 was discovered to contain a SQL injection vulnerability in the /utils/sql-parser.ts component. This vulnerability allows attackers to access sensitive databse information via a crafted SQL statement...