2557 matches found
CVE-2015-20108
xmlsecurity.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not used...
CVE-2005-2206
Multiple SQL injection vulnerabilities in CartWIZ allow remote attackers to modify SQL statements via the 1 idProduct parameter to tellAFriend.asp, 2 sortType parameter to viewSupportTickets.asp, or the id parameter to 3 updateCreditCards.asp or 4 deleteCreditCards.asp...
CVE-2005-2284
Multiple SQL injection vulnerabilities in WebEOC before 6.0.2 allow remote attackers to modify SQL statements via unknown attack vectors...
CampCodes Sales and Inventory System 注入漏洞
CampCodes Sales and Inventory System is a sales and inventory system from CampCodes, Inc. The CampCodes Sales and Inventory System suffers from a SQL injection vulnerability that stems from a lack of validation of the parameter ID in the file /pages/purchaseadd.php for externally entered SQL...
CVE-2025-32969
XWiki is a generic wiki platform. In versions starting from 1.8 and prior to 15.10.16, 16.4.6, and 16.10.1, it is possible for a remote unauthenticated user to escape from the HQL execution context and perform a blind SQL injection to execute arbitrary SQL statements on the database backend,...
CVE-2025-29649
SQL Injection vulnerability exists in the TP-Link TL-WR840N router s login dashboard version 1.0, allowing an unauthenticated attacker to inject malicious SQL statements via the username and password fields. NOTE: this is disputed because the issue can only be reproduced on a supplier-provided...
CVE-2025-29648
SQL Injection vulnerability exists in the TP-Link EAP120 router s login dashboard version 1.0, allowing an unauthenticated attacker to inject malicious SQL statements via the login fields. NOTE: this is disputed because the issue can only be reproduced on a supplier-provided emulator, where acces...
CVE-2025-29653
SQL Injection vulnerability exists in the TP-Link M7450 4G LTE Mobile Wi-Fi Router Firmware Version: 1.0.2 Build 170306 Rel.1015n, allowing an unauthenticated attacker to inject malicious SQL statements via the username and password fields...
CVE-2025-29653
TP-Link M7450 4G LTE Mobile Wi‑Fi Router is affected by CVE-2025-29653 as reported in multiple sources (Red Hat and PT-2025-16890). The vulnerability is a SQL Injection in firmware version 1.0.2 Build 170306 Rel.1015n, exploitable via the username and password fields. The PT-2025-16890 descriptio...
CVE-2025-29648
CVE-2025-29648 is rejected/not used per the Initial Description.
WordPress plugin Motors 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...
SAP S/4HANA Manage Bank Statements Data Compromise
The vulnerability of the “Manage Bank Statements” component of the SAP S/4HANA software platform involves bypassing authentication using a key controlled by the user. Exploiting this vulnerability could allow an attacker, operating remotely, to compromise the integrity of the protected informatio...
Aussie Fintech Vroom Exposes Thousands of Records After AWS Misconfiguration
Cybersecurity researcher Jeremiah Fowler discovered a data exposure at Australian fintech Vroom by YouX, exposing 27,000 records, including driver's licenses, bank statements, and more...
PT-2025-12960
Name of the Vulnerable Software and Affected Versions NotFound Docpro versions n/a through 2.0.1 Description The issue affects NotFound Docpro due to improper control of filename for Include/Require statements in PHP programs, allowing PHP Local File Inclusion. This is also referred to as PHP...
ROS-20250326-11
A vulnerability in the sqlghashsource component of the virtuoso-opensource web application development platform is related to the unconstrained and unregulated resource allocation. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service using special...
SQL Injection
Overview vanna is a Generate SQL queries from natural language Affected versions of this package are vulnerable to SQL Injection by injecting a series of PUT and COPY statements as raw SQL using the "Manually Fix" feature in the Snowflake database integration. The runsqlsnowflake function will...
CVE-2024-11958 SQL Injection in run-llama/llama_index
A SQL injection vulnerability exists in the duckdbretriever component of the run-llama/llamaindex repository, specifically in the latest version. The vulnerability arises from the construction of SQL queries without using prepared statements, allowing an attacker to inject arbitrary SQL code. Thi...