GHSA-R8CR-4F9W-7R75 Netmaker has a boolean‑based SQL Injection

SQL Injection in Netmaker SQLite Database Backend Summary The sqliteDeleteRecord function in Netmaker's database layer constructs SQL DELETE statements using direct string concatenation of user-supplied input. This allows an authenticated attacker to perform boolean-based SQL injection. --- Detai...

Netmaker has a boolean‑based SQL Injection

SQL Injection in Netmaker SQLite Database Backend Summary The sqliteDeleteRecord function in Netmaker's database layer constructs SQL DELETE statements using direct string concatenation of user-supplied input. This allows an authenticated attacker to perform boolean-based SQL injection. --- Detai...

PT-2026-92417

SQL Injection in Netmaker SQLite Database Backend Summary The sqliteDeleteRecord function in Netmaker's database layer constructs SQL DELETE statements using direct string concatenation of user-supplied input. This allows an authenticated attacker to perform boolean-based SQL injection. --- Detai...

CVE-2026-66738

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An...

CVE-2026-66738

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An...

EUVD-2026-55655

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An...

Linux Distros Unpatched Vulnerability : CVE-2026-66738

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user inpu...

CVE-2026-71282 ChirpStack SQLite Backend SQL Injection via Device Tag Key in ListDevices Filter

ChirpStack's SQLite-backend device tag filtering chirpstack/src/storage/device.rs, in both getcount and list interpolates the user-supplied tag KEY directly into a raw SQL fragment via Rust's format! macro , while only the tag VALUE is safely parameter-bound via Diesel's .bind...

CVE-2026-71282 ChirpStack SQLite Backend SQL Injection via Device Tag Key in ListDevices Filter

ChirpStack's SQLite-backend device tag filtering chirpstack/src/storage/device.rs, in both getcount and list interpolates the user-supplied tag KEY directly into a raw SQL fragment via Rust's format! macro , while only the tag VALUE is safely parameter-bound via Diesel's .bind...

CVE-2026-71282

ChirpStack SQLite backend has a SQL injection risk in device tag filtering. In ChirpStack’s SQLite code path (chirpstack-sqlite), the code interpolates the user-supplied tag KEY directly into a raw SQL fragment using format!(), while the tag VALUE is bound safely via Diesel. This means an authent...

CVE-2026-71282 ChirpStack SQLite Backend SQL Injection via Device Tag Key in ListDevices Filter

ChirpStack's SQLite-backend device tag filtering chirpstack/src/storage/device.rs, in both getcount and list interpolates the user-supplied tag KEY directly into a raw SQL fragment via Rust's format! macro , while only the tag VALUE is safely parameter-bound via Diesel's .bind...

CVE-2026-71282

ChirpStack's SQLite-backend device tag filtering chirpstack/src/storage/device.rs, in both getcount and list interpolates the user-supplied tag KEY directly into a raw SQL fragment via Rust's format! macro , while only the tag VALUE is safely parameter-bound via Diesel's .bind...

EUVD-2026-53367

ChirpStack's SQLite-backend device tag filtering chirpstack/src/storage/device.rs, in both getcount and list interpolates the user-supplied tag KEY directly into a raw SQL fragment via Rust's format! macro dsl::sql::&format!"device.tags-'' =", k.bind::v, while only the tag VALUE is safely...

CVE-2026-71282: Improper Neutralization of Special Elements used in an SQL Command

ChirpStack's SQLite-backend device tag filtering chirpstack/src/storage/device.rs, in both getcount and list interpolates the user-supplied tag KEY directly into a raw SQL fragment via Rust's format! macro , while only the tag VALUE is safely parameter-bound via Diesel's .bind...

CVE-2026-49279

CVE-2026-49279 (WWBN AVideo) describes a stored XSS in the WebSocket messaging system. The vulnerability arises because MessageSQLite.php only strips autoEvalCodeOnHTML from json["msg"], while msgToResourceId() favors json over msg, allowing an attacker to place the payload in json and bypass san...

EUVD-2026-44825

WWBN AVideo is an open source video platform. Versions 29.0 and below contain a Stored XSS vulnerability through the autoEvalCodeOnHTML parameter in the MessageSQLite WebSocket Handler. The MessageSQLite.php handler only strips autoEvalCodeOnHTML from $json'msg', but msgToResourceId reads from...

CVE-2026-49279 WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass)

WWBN AVideo is an open source video platform. Versions 29.0 and below contain a Stored XSS vulnerability through the autoEvalCodeOnHTML parameter in the MessageSQLite WebSocket Handler. The MessageSQLite.php handler only strips autoEvalCodeOnHTML from $json'msg', but msgToResourceId reads from...

CVE-2026-49279

WWBN AVideo is an open source video platform. Versions 29.0 and below contain a Stored XSS vulnerability through the autoEvalCodeOnHTML parameter in the MessageSQLite WebSocket Handler. The MessageSQLite.php handler only strips autoEvalCodeOnHTML from $json'msg', but msgToResourceId reads from...

GHSA-H5X4-M2QF-R4F2 Diesel's SQLite backend has possible UTF-8 corruption

Diesel uses the sqlite3valuetext function to receive strings from SQLite while deserializing query results. We misinterpreted the corresponding SQLite documentation that this function always returns a UTF-8 encoded string values as const cchar. Based on that we used str::fromutf8unchecked to...

Unsound transmute while debug/display printing batch Insert statements in Diesel's SQLite backend

Diesel allows users to output the generated SQL for any query DSL construct via th diesel::debugquery function as Display and Debug output. For the particular implementation used by batch Insert statements in the SQLite backend Diesel relied on an unspecified transmute between types with a reprru...