287225 matches found
CVE-2026-67401
A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component...
CVE-2026-67401
A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component...
EUVD-2026-75062
A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component...
CVE-2026-67401
A SQL injection vulnerability in cPanel's EmailTrack component allows a mail-enabled hosting account to achieve remote code execution as root . Affected versions include 11.110, 11.134, 11.136, 11.138 , and WP Squared 11.138.1.9 , or any build below the patched version. The CVSS score is 9.9 (Cri...
Vulnerabilities in Adobe ColdFusion
Adobe has identified several vulnerabilities in Adobe ColdFusion. These vulnerabilities include a stored Cross-Site Scripting XSS vulnerability, where an attacker with low privileges can inject malicious scripts into form fields, which are then executed in the user’s browser. There is also a...
Exploit for CVE-2026-79387
CVE-2026-79387: SQL Injection in PbootCMS V3.2.5 User Manageme...
WordPress Quotes llama plugin < 3.1.6 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Pablo González Pérez in WordPress Plugin Quotes llama versions 3.1.6...
WordPress Verified Reviews (Avis Vérifiés) plugin <= 2.4.6 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Mael MARTIN, Othmane EL AYADI in WordPress Plugin Verified Reviews Avis Vérifiés versions = 2.4.6...
CVE-2026-87807
siyuan versions before v3.8.2 contain an authenticated SQL injection vulnerability in the fullTextSearchBlock endpoint's method=1 query parameter. Attackers can inject UNION SELECT statements to read the entire blocks table, bypassing publish-access controls and exposing all document content and...
CVE-2026-87808
SiYuan versions = 3.8.1 contain an incomplete fix for CVE-2026-32767 GHSA-j7wh-x834-p3r7. The prior fix commit d5e2d0bc added an administrator check for SQL mode method=2 in POST /api/search/fullTextSearchBlock, but the endpoint still does not enforce the application's read-only boundary: for...
CVE-2026-79972
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability. A high privileged attacker with remote access could potentially exploit this...
CVE-2026-79972
Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application editions are affected by an SQL Injection vulnerability (Improper Neutralization of Special Elements used in an SQL Command). Affected versions are Appliance prior to 5.36.00.16 and Application prior to 5.36.00.00 . A high-privileged...
CVE-2026-79972
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability. A high privileged attacker with remote access could potentially exploit this...
CVE-2026-79972
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability. A high privileged attacker with remote access could potentially exploit this...
EUVD-2026-74855
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability. A high privileged attacker with remote access could potentially exploit this...
CLSA-2026-1788954836 postgresql: Fix of 11 CVEs
CVE-2026-14670: PL/Perl: harden against "tied" Perl arrays and hashes in plperl and hstoreplperl - CVE-2026-14680: reject SQL-level calls to functions taking or returning "internal", and return nulls honestly in numeric aggregate combine functions - CVE-2026-16239: cross-check the tuple...
CVE-2026-87808 SiYuan before v3.8.2 Read-Only Boundary Bypass via fullTextSearchBlock
SiYuan versions = 3.8.1 contain an incomplete fix for CVE-2026-32767 GHSA-j7wh-x834-p3r7. The prior fix commit d5e2d0bc added an administrator check for SQL mode method=2 in POST /api/search/fullTextSearchBlock, but the endpoint still does not enforce the application's read-only boundary: for...
CVE-2026-87808 SiYuan before v3.8.2 Read-Only Boundary Bypass via fullTextSearchBlock
SiYuan versions = 3.8.1 contain an incomplete fix for CVE-2026-32767 GHSA-j7wh-x834-p3r7. The prior fix commit d5e2d0bc added an administrator check for SQL mode method=2 in POST /api/search/fullTextSearchBlock, but the endpoint still does not enforce the application's read-only boundary: for...
CVE-2026-87808
SiYuan versions prior to v3.8.2 contain an incomplete fix for CVE-2026-32767. The POST /api/search/fullTextSearchBlock endpoint, when invoked with method=2, forwards caller-supplied SQL to the blocks database query path without calling model.CheckReadonly or CheckReadonlyStatementInBox. As a resu...
EUVD-2026-74834
SiYuan versions = 3.8.1 contain an incomplete fix for CVE-2026-32767 GHSA-j7wh-x834-p3r7. The prior fix commit d5e2d0bc added an administrator check for SQL mode method=2 in POST /api/search/fullTextSearchBlock, but the endpoint still does not enforce the application's read-only boundary: for...