EUVD-2026-63687

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG opened superuser connections without pinning searchpath in fillDefaultParameters in pkg/management/postgres/pool/profiles.go. A role holding DATABASE OWNER...

CVE-2026-46682

BigBlueButton (open-source virtual classroom) is vulnerable to SQL injection in versions prior to 3.0.23 . The flaw resides in the refreshBreakoutRoomsVisibleForUsers method within BreakoutRoomUserDAO.scala, which interpolates meetingId and userId values directly into breakout room visibility que...

CVE-2026-46682 BigBlueButton: Blind SQL Injection AUTH (Moderator)

BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton allowed authenticated moderators to inject SQL through the meetingId and userId values used by refreshBreakoutRoomsVisibleForUsers in akka-bbb-apps/src/main/scala/org/bigbluebutton/core/db/BreakoutRoomUserDAO.scala...

EUVD-2026-63677

BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton allowed authenticated moderators to inject SQL through the meetingId and userId values used by refreshBreakoutRoomsVisibleForUsers in akka-bbb-apps/src/main/scala/org/bigbluebutton/core/db/BreakoutRoomUserDAO.scala...

CVE-2026-46682 BigBlueButton: Blind SQL Injection AUTH (Moderator)

BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton allowed authenticated moderators to inject SQL through the meetingId and userId values used by refreshBreakoutRoomsVisibleForUsers in akka-bbb-apps/src/main/scala/org/bigbluebutton/core/db/BreakoutRoomUserDAO.scala...

CVE-2026-2413

CVE-2026-2413 Ally – Web Accessibility & Usability = 4.0.3 - URL पथ के माध्यम से बिना प्रमाणीकरण के SQL इंजेक्शन विवरण WordPress के लिए Ally – Web Accessibility & Usability प्लगइन, संस्करण 4.0.3 तक 4.0.3 सहित के सभी संस्करणों में URL पथ के माध्यम से SQL इंजेक्शन के प्रति संवेदनशील है। इसका कारण...

Collabfiltrator

Collabfiltrator Exfiltriere Ausgaben blinder Remote-Code-Execution- und SQL-Injection-Angriffe über DNS via Burp Collaborator. Version: 4.0.1 Autoren: Adam Logue Jared McLaren Frank Scarpella Ryan Griffin KI-Autoren: Claude 3.5 Sonnet ChatGPT 4o Anforderungen: Burp Suite Professional 2024.12.1 od...

Fleet: ORDER BY column injection on activity list endpoints

Summary An authenticated user with read access to Activity could influence the ORDER BY clause of the activity list endpoints by supplying an arbitrary sort column: - GET /api/v1/fleet/activities ListActivities - GET /api/v1/fleet/hosts/id/activities ListHostPastActivities This originated from th...

GHSA-7Q96-F8XW-JV5J Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database

Summary A SQL injection vulnerability in Fleet's Okta conditional access integration could allow an attacker who controls a single enrolled host to read or modify arbitrary data in the Fleet database, including stored session tokens. Disclosed session tokens may be replayed to act as a global...

Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database

Summary A SQL injection vulnerability in Fleet's Okta conditional access integration could allow an attacker who controls a single enrolled host to read or modify arbitrary data in the Fleet database, including stored session tokens. Disclosed session tokens may be replayed to act as a global...

php8.4 security, bug fix, and enhancement update

An update is available for php8.4. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list PHP is an HTML-embedded scripting language. PHP attempts to make it easy for...

RLSA-2026:56969 Important: php8.4 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

php:8.3 security, bug fix, and enhancement update

An update is available for module.php-pecl-redis6, php, module.php-pecl-rrd, php-pecl-apcu, module.php-pecl-apcu, php-pecl-zip, php-pecl-rrd, module.php, module.php-pecl-zip, php-pecl-redis6, php-pecl-xdebug3, module.php-pecl-xdebug3. This update affects Rocky Linux 9. A Common Vulnerability...

RLSA-2026:57539 Important: php:8.3 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archives CVE-2026-7260 Bug Fixes and Enhancements...

CVE-2026-72550-poc

CVE-2026-72550 — Iniezione SQL non autenticata in Friendica L'iniezione SQL a query impilate non autenticata nell'endpoint delle foto di Friendica consente a qualsiasi visitatore di eseguire SQL arbitrario...

CVE-2026-77020

A vulnerability was identified in CodeAstro Apartment Visitor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file password-recovery.php. The manipulation of the argument email leads to sql injection. Remote exploitation of the attack is possible. The...

CVE-2026-77019

A vulnerability was determined in CodeAstro Apartment Visitor Management System 1.0. Affected is an unknown function of the file /apartment-visitor/forgotpw.php. Executing a manipulation of the argument secode can lead to sql injection. The attack may be launched remotely. The exploit has been...

CVE-2026-77025

A weakness has been identified in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /viewappointmentpending.php. This manipulation of the argument delid causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available...

EUVD-2026-63485

A weakness has been identified in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /viewappointmentpending.php. This manipulation of the argument delid causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available...

CVE-2026-77025 itsourcecode Hospital Management System viewappointmentpending.php sql injection

A weakness has been identified in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /viewappointmentpending.php. This manipulation of the argument delid causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available...