283189 matches found
EUVD-2026-89363
bytebase dbhub v1.2.0 was discovered to contain a SQL injection vulnerability in the /utils/sql-parser.ts component. This vulnerability allows attackers to access sensitive databse information via a crafted SQL statement...
PT-2026-102499
Apache Airflow's Snowflake provider did not validate the connection's account and region fields before interpolating them into request URLs. The SQL API endpoint is built as https://account.snowflakecomputing.com/api/v2/statements, so an account value containing /, ? or demotes the intended domai...
CVE-2026-81930: Insufficiently Protected Credentials
Apache Airflow's Snowflake provider did not validate the connection's account and region fields before interpolating them into request URLs. The SQL API endpoint is built as https://account.snowflakecomputing.com/api/v2/statements, so an account value containing /, ? or demotes the intended domai...
CVE-2026-101091
SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyuan.db. Attackers can craft malicious .sy documents with non-read-only SQL statements that execute automatically during background indexing, rendering, or export operations witho...
CVE-2026-101091 SiYuan before v3.8.4 SQL Injection via Block Query Embed
SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyuan.db. Attackers can craft malicious .sy documents with non-read-only SQL statements that execute automatically during background indexing, rendering, or export operations witho...
CVE-2026-101091
SiYuan versions before v3.8.4 are vulnerable to a SQL injection flaw because they fail to properly validate SQL statements in block query embed blocks executed against siyuan.db . An attacker can craft malicious .sy documents containing non-read-only SQL statements. These statements execute autom...
CVE-2026-101091 SiYuan before v3.8.4 SQL Injection via Block Query Embed
SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyuan.db. Attackers can craft malicious .sy documents with non-read-only SQL statements that execute automatically during background indexing, rendering, or export operations witho...
CVE-2026-101091 SiYuan before v3.8.4 SQL Injection via Block Query Embed
SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyuan.db. Attackers can craft malicious .sy documents with non-read-only SQL statements that execute automatically during background indexing, rendering, or export operations witho...
Security Bulletin: Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components
Summary Langflow contains multiple Server-Side Request Forgery vulnerabilities across several components where authenticated users can supply attacker-controlled URLs or database connection strings that reach internal network hosts without adequate validation. The LMStudio model and embeddings...
CVE-2026-101110
Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library Free quote instead of rejecting it. The value is then concatenated directly into an unquoted ORDER BY clause, a position where quoting provides no protection at all. Reaching the vulnerable code path requires two...
CVE-2026-101105
A vulnerability was determined in code-projects Matrimonial System 1.0. The affected element is the function processprofileform of the file /createprofile of the component Profile Creation Endpoint. This manipulation of the argument fname causes sql injection. The attack is possible to be carried...
CVE-2026-100752
Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager Free 6.7.9 - site/realestatemanager.php builds the ORDER BY clause of three separate frontend property-listing queries category browsing, search results, and the full property listing from a request-controlled...
CVE-2026-101108
Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager Free 6.5.8 - site/vehiclemanager.php reads the orderfield and orderdirection sort parameters at three separate anonymous-reachable frontend entry points category listing, search, and the all-vehicles listing throug...
EUVD-2026-88436
Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library Free quote instead of rejecting it. The value is then concatenated directly into an unquoted ORDER BY clause, a position where quoting provides no protection at all. Reaching the vulnerable code path requires two...
CVE-2026-101110 Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6.4.6
Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library Free quote instead of rejecting it. The value is then concatenated directly into an unquoted ORDER BY clause, a position where quoting provides no protection at all. Reaching the vulnerable code path requires two...
CVE-2026-101110
The Book Library (Free) Joomla Extension by ordasoft.com (versions
CVE-2026-101110 Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6.4.6
Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library Free quote instead of rejecting it. The value is then concatenated directly into an unquoted ORDER BY clause, a position where quoting provides no protection at all. Reaching the vulnerable code path requires two...
CVE-2026-100752 Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9
Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager Free 6.7.9 - site/realestatemanager.php builds the ORDER BY clause of three separate frontend property-listing queries category browsing, search results, and the full property listing from a request-controlled...
CVE-2026-100752 Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9
Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager Free 6.7.9 - site/realestatemanager.php builds the ORDER BY clause of three separate frontend property-listing queries category browsing, search results, and the full property listing from a request-controlled...