1447 matches found
EUVD-2021-25775
Malware in sbrugna...
EUVD-2018-17757
Malware in sbrugna...
EUVD-2021-19551
Malware in sbrugna...
EUVD-2021-15905
Malware in sbrugna...
EUVD-2021-16988
Malware in sbrugna...
EUVD-2014-2744
Malware in sbrugna...
CVE-2025-10696
OpenSupports exposes an endpoint that allows the list of 'supervised users' for any account to be edited, but it does not validate whether the actor is the owner of that list. A Level 1 staff member can modify the supervision relationship of a third party the target user, who can then view the...
CVE-2025-10692
The endpoint POST /api/staff/get-new-tickets concatenates the user-controlled parameter departmentId directly into the SQL WHERE clause without parameter binding. As a result, an authenticated staff user level ≥ 1 can inject SQL to alter the filter logic, effectively bypassing department scoping...
EUVD-2025-32372
The endpoint POST /api/staff/get-new-tickets concatenates the user-controlled parameter departmentId directly into the SQL WHERE clause without parameter binding. As a result, an authenticated staff user level ≥ 1 can inject SQL to alter the filter logic, effectively bypassing department scoping...
CVE-2025-10692 OpenSupports 4.11.0 — SQL Injection
The endpoint POST /api/staff/get-new-tickets concatenates the user-controlled parameter departmentId directly into the SQL WHERE clause without parameter binding. As a result, an authenticated staff user level ≥ 1 can inject SQL to alter the filter logic, effectively bypassing department scoping...
CVE-2025-10692
CVE-2025-10692 describes an SQL injection in OpenSupports 4.11.0 via POST /api/staff/get-new-tickets, where the user-supplied departmentId is concatenated into the SQL WHERE clause without parameter binding. An authenticated staff user (level ≥ 1) can alter filtering to access tickets outside the...
CVE-2025-10692 OpenSupports 4.11.0 — SQL Injection
The endpoint POST /api/staff/get-new-tickets concatenates the user-controlled parameter departmentId directly into the SQL WHERE clause without parameter binding. As a result, an authenticated staff user level ≥ 1 can inject SQL to alter the filter logic, effectively bypassing department scoping...
EUVD-2022-32477
Malicious code in bioql PyPI...
EUVD-2024-36834
Malicious code in bioql PyPI...
EUVD-2024-53986
Malicious code in bioql PyPI...
EUVD-2024-43340
Malicious code in bioql PyPI...
EUVD-2022-52774
Malicious code in bioql PyPI...
EUVD-2023-32425
Malicious code in bioql PyPI...