2544 matches found
CVE-2026-65321
PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attackers to inject arbitrary SQL by exploiting improper quote-escaping in DefaultParameterFormatter.format, which routes DELETE and CTAS statements to the escapehive function that backslash-escapes single...
CVE-2026-65321: Improper Neutralization of Special Elements used in an SQL Command
PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attackers to inject arbitrary SQL by exploiting improper quote-escaping in DefaultParameterFormatter.format, which routes DELETE and CTAS statements to the escapehive function that backslash-escapes single...
CVE-2026-15951
The Icegram Mailer plugin for WordPress is vulnerable to SQL Injection via the 'fields' parameter in versions up to, and including, 1.0.12. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the...
EUVD-2026-44802
NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE...
Linux Distros Unpatched Vulnerability : CVE-2026-58041
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSynccreateTagStore to continue executing a cached prepared statement...
GHSA-RWQX-FVQH-6WM4 OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords
OpenTelemetry Java Instrumentation JDBC auto-instrumentation may fail to sanitize passwords in SQL CONNECT statements when the password is double-quoted. As a result, clear-text database passwords can be added to trace span attributes and exported to observability backends...
Insertion of Sensitive Information into Log File
Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the process of logging SQL CONNECT statements, where passwords enclosed in double quotes are not properly sanitized. An attacker can obtain sensitive database credentials by accessing...
OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords
OpenTelemetry Java Instrumentation JDBC auto-instrumentation may fail to sanitize passwords in SQL CONNECT statements when the password is double-quoted. As a result, clear-text database passwords can be added to trace span attributes and exported to observability backends...
Malicious Package
Overview bigops-statements-timeline is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...
Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector
Summary This is a related but independently fixable vulnerability to GHSA-qqf5-x7mj-v43p PostgreSQL SQL injection, reported in the same original disclosure and split per GitHub CNA guidance rule 4.2.11 since it affects a separate integration, has a distinct attack precondition, and requires a...
GHSA-2XGG-R2WC-C5R2 Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector
Summary This is a related but independently fixable vulnerability to GHSA-qqf5-x7mj-v43p PostgreSQL SQL injection, reported in the same original disclosure and split per GitHub CNA guidance rule 4.2.11 since it affects a separate integration, has a distinct attack precondition, and requires a...
SQL Injection
Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to SQL Injection via the multipleStatements configuration in the MySQL integration. An attacker can execute arbitrary SQL commands by injecting malicious input into user fields, potentially leading...
GHSA-Q6X4-V3QX-85QW Budibase: SQL Injection via `multipleStatements: true`
Summary A critical SQL injection vulnerability was discovered in Budibase's MySQL integration that allows remote attackers to execute arbitrary SQL commands. Details Vulnerability Type SQL Injection Description The MySQL integration component in Budibase is configured with multipleStatements: tru...
Budibase: SQL Injection via `multipleStatements: true`
Summary A critical SQL injection vulnerability was discovered in Budibase's MySQL integration that allows remote attackers to execute arbitrary SQL commands. Details Vulnerability Type SQL Injection Description The MySQL integration component in Budibase is configured with multipleStatements: tru...
Duplicate Advisory: Writes in a PERMISSIONS clause bypass table permissions
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-66r2-5gwj-gxm2. This link is maintained to preserve external references. Original Description SurrealDB versions before 3.2.0 contain a permissions bypass vulnerability where data-modifying statements within...
CVE-2026-63733 SurrealDB before 3.2.0 Permissions Bypass via PERMISSIONS Clause
SurrealDB versions before 3.2.0 contain a permissions bypass vulnerability where data-modifying statements within PERMISSIONS clauses execute with enforcement disabled. Attackers with permission to perform a guarded operation can write to tables they lack permission for by embedding CREATE, UPDAT...
CVE-2026-63733 SurrealDB before 3.2.0 Permissions Bypass via PERMISSIONS Clause
SurrealDB versions before 3.2.0 contain a permissions bypass vulnerability where data-modifying statements within PERMISSIONS clauses execute with enforcement disabled. Attackers with permission to perform a guarded operation can write to tables they lack permission for by embedding CREATE, UPDAT...
CVE-2024-58370
SurrealDB before 1.1.0 is affected: the parser does not enforce recursion depth limits for nested SurrealQL statements (including IF, RELATE, and attribute access). This allows an attacker to submit queries with excessive nesting, potentially causing a stack overflow and server crash. Affected pr...
PT-2026-60861
Name of the Vulnerable Software and Affected Versions IBM Db2 versions 11.5.0 through 11.5.9 IBM Db2 versions 12.1.0 through 12.1.4 Description A trap occurs during the compilation of specially crafted statements containing subqueries, which can lead to a denial of service. Recommendations At the...