1695 matches found
EUVD-2022-56016
Weaver Fanwei E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. Attackers can send a single crafted GET reques...
CVE-2022-50997 Weaver E-cology 8.0 / 9.0 SQL Injection via HrmCareerApplyPerView.jsp
Weaver Fanwei E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. Attackers can send a single crafted GET reques...
CVE-2022-50997
The CVE-2022-50997 entry concerns Weaver (Fanwei) E-cology 8.0 and 9.0, where a SQL injection vulnerability exists in the HrmCareerApplyPerView.jsp endpoint. An unauthenticated attacker can manipulate the id parameter (via a crafted GET request) to perform UNION-based injections against a Microso...
CVE-2016-20097
CVE-2016-20097 involves Weaver (Fanwei) E-cology 8.0. A vulnerability in the SignatureDownLoad servlet allows unauthenticated remote attackers to perform a SQL injection via the markId parameter, which is concatenated into a query. This can let an attacker control the returned markPath value and ...
EUVD-2016-10910
Weaver Fanwei E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet that allows unauthenticated remote attackers to read arbitrary files by injecting a UNION SELECT payload into the markId GET parameter, which is concatenated unsanitized into a SQL query. Attackers...
CVE-2016-20097 Weaver E-cology 8.0 SQL Injection File Read via SignatureDownLoad
Weaver Fanwei E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet that allows unauthenticated remote attackers to read arbitrary files by injecting a UNION SELECT payload into the markId GET parameter, which is concatenated unsanitized into a SQL query. Attackers...
PT-2026-70800
Weaver Fanwei E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet that allows unauthenticated remote attackers to read arbitrary files by injecting a UNION SELECT payload into the markId GET parameter, which is concatenated unsanitized into a SQL query. Attackers...
VulnCheck KEV: CVE-2016-20097
Weaver Fanwei E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet that allows unauthenticated remote attackers to read arbitrary files by injecting a UNION SELECT payload into the markId GET parameter, which is concatenated unsanitized into a SQL query. Attackers...
VulnCheck KEV: CVE-2022-50997
Weaver Fanwei E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. Attackers can send a single crafted GET reques...
CVE-2026-68174
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix union collision of module and refcnt for dynamic events In 'struct traceeventcall', the 'module' pointer and the 'refcnt' atomic variable share the same memory space in a union. For dynamic events, the union member i...
UBUNTU-CVE-2026-68174
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix union collision of module and refcnt for dynamic events In 'struct traceeventcall', the 'module' pointer and the 'refcnt' atomic variable share the same memory space in a union. For dynamic events, the union member i...
EUVD-2026-55375
In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Fix buffer overflow in steered register list allocation The size calculation for the steered register extarray uses only the geometry DSS mask gdssmask to determine the number of entries to allocate: total =...
CVE-2026-68274
The CVE-2026-68274 issue affects the Linux kernel component drm/xe/guc where allocation size for the steered register list uses only g_dss_mask, while the iteration over DSS bits includes both g_dss_mask and c_dss_mask. This mismatch can cause a buffer overflow, leading to memory corruption (list...
EUVD-2026-55275
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix union collision of module and refcnt for dynamic events In 'struct traceeventcall', the 'module' pointer and the 'refcnt' atomic variable share the same memory space in a union. For dynamic events, the union member i...
CVE-2026-68174: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix union collision of module and refcnt for dynamic events In 'struct traceeventcall', the 'module' pointer and the 'refcnt' atomic variable share the same memory space in a union. For dynamic events, the union member i...
CVE-2026-71237
Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from 'pwd' with no sanitization and concatenates it into a raw SQL string: mysqlquery"select from userlists where username='' and password='' limit 1". An unauthenticated attacker can submit a payload...
CVE-2026-71237 Miantang IoT-PHP - Unauthenticated SQL Injection in /userlogin
Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from 'pwd' with no sanitization and concatenates it into a raw SQL string: mysqlquery"select from userlists where username='' and password='' limit 1". An unauthenticated attacker can submit a payload...
CVE-2026-8029
The ZTE Smart Life app contains an SQL injection vulnerability that allows attackers to execute UNION SELECT statements to query sensitive data in the feedback.db database across tables, including user accounts, phone numbers, feedback content, and local debug log paths, thereby enabling the thef...
CVE-2026-8029 SQL Injection Vulnerability in ZTE SmartLife App
The ZTE Smart Life app contains an SQL injection vulnerability that allows attackers to execute UNION SELECT statements to query sensitive data in the feedback.db database across tables, including user accounts, phone numbers, feedback content, and local debug log paths, thereby enabling the thef...
EUVD-2026-53292
The ZTE Smart Life app contains an SQL injection vulnerability that allows attackers to execute UNION SELECT statements to query sensitive data in the feedback.db database across tables, including user accounts, phone numbers, feedback content, and local debug log paths, thereby enabling the thef...