247550 matches found
CVE-2026-72853
Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in identifiers. Attackers with write permission on a table with a double-quote in its name can inject SQL that executes as the datasource's...
CVE-2026-72853
Budibase prior to 3.40.0 is affected by a SQL injection in the Oracle datasource connector’s post-write row lookup, due to failure to escape table names in identifiers. An attacker with write access on a table whose name contains a double-quote can inject SQL that executes as the datasource’s dat...
CVE-2026-72853 Budibase before 3.40.0 SQL Injection via Oracle connector
Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in identifiers. Attackers with write permission on a table with a double-quote in its name can inject SQL that executes as the datasource's...
CVE-2026-72851
Budibase before 3.40.0 contains an unauthenticated SQL injection in webhook-triggered automations using EXECUTE_QUERY steps. An attacker can POST JSON to the webhook trigger endpoint to inject SQL payloads that run with builder-configured database credentials, enabling data exfiltration, modifica...
CVE-2026-72853 Budibase before 3.40.0 SQL Injection via Oracle connector
Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in identifiers. Attackers with write permission on a table with a double-quote in its name can inject SQL that executes as the datasource's...
CVE-2026-72853 Budibase before 3.40.0 SQL Injection via Oracle connector
Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in identifiers. Attackers with write permission on a table with a double-quote in its name can inject SQL that executes as the datasource's...
CVE-2026-72851 Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook
Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTEQUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials,...
CVE-2026-73663
The CVE concerns FreePBX missedcall module (affected in 16.0.0–16.0.11 and 17.0.4) where inbound Caller ID name from crafted SIP From headers is inserted into missedcalllog without escaping or bound parameters, enabling unauthenticated SQL injection that can corrupt the database and modify admini...
EUVD-2026-58486
FreePBX is an open source IP PBX. From 16.0.0 until 16.0.11 and 17.0.4, the FreePBX missedcall module places the inbound Caller ID name from crafted SIP From headers into the missedcalllog INSERT in agi-bin/missedcallnotify.php without escaping or bound parameters. An unauthenticated caller can...
CVE-2026-73663 FreePBX: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeover
FreePBX is an open source IP PBX. From 16.0.0 until 16.0.11 and 17.0.4, the FreePBX missedcall module places the inbound Caller ID name from crafted SIP From headers into the missedcalllog INSERT in agi-bin/missedcallnotify.php without escaping or bound parameters. An unauthenticated caller can...
CVE-2026-73663
FreePBX is an open source IP PBX. From 16.0.0 until 16.0.11 and 17.0.4, the FreePBX missedcall module places the inbound Caller ID name from crafted SIP From headers into the missedcalllog INSERT in agi-bin/missedcallnotify.php without escaping or bound parameters. An unauthenticated caller can...
CVE-2026-73663 FreePBX: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeover
FreePBX is an open source IP PBX. From 16.0.0 until 16.0.11 and 17.0.4, the FreePBX missedcall module places the inbound Caller ID name from crafted SIP From headers into the missedcalllog INSERT in agi-bin/missedcallnotify.php without escaping or bound parameters. An unauthenticated caller can...
Exploit for SQL Injection in Metabase
CVE-2026-72898...
CVE-2026-73427 vulnerabilities
Vulnerabilities for packages: ruby3.3-rails, ruby3.2-rails, ruby3.4-rails, ruby4.0-rails...
CVE-2026-73418 vulnerabilities
Vulnerabilities for packages: jitsucom-jitsu, langfuse...
GHSA-HF6X-8P5F-CGMF vulnerabilities
Vulnerabilities for packages: zipkin, opensearch, kserve-modelmesh, nrjmx, druid, sonarqube, wavefront-proxy, flyway, cassandra-reaper, akhq, thingsboard, apicurio-registry, logstash...
CVE-2026-73651
creationtimestamp| type| source ---|---|--- 2026-08-13 20:35:04+00:00| published-proof-of-concept| https://github.com/typeorm/typeorm/security/advisories/GHSA-2rp8-mm9q-fp49...
CVE-2026-73490 vulnerabilities
Vulnerabilities for packages: ruby3.4-rails, gitlab-rails-ce-fips, ruby3.2-rails, pghero-fips, gitlab-rails-ce, ruby4.0-rails, ruby3.3-rails, pghero...