Pi.Alert SQL injection vulnerability

Pi.Alert is a WIFI/LAN intrusion detector developed by the individual developer jokob-sk. Versions of Pi.Alert prior to version 2026-05-07 contained an SQL injection vulnerability. This vulnerability stemmed from improper handling of the action and scansource parameters in requests sent to...

CVE-2025-57792: Improper Neutralization of Special Elements used in an SQL Command

Explorance Blue versions prior to 8.14.9 contain a SQL injection vulnerability caused by insufficient validation of user input in a web application endpoint. An attacker can supply crafted input that is executed as part of backend database queries. The issue is exploitable without authentication,...

PT-2025-40025

Name of the Vulnerable Software and Affected Versions MegaSys Telenium Online Web Application affected versions not specified Description The Telenium Online Web Application contains a critical command injection flaw stemming from an insecurely terminated regular expression check within a PHP...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the q URL parameter in the /api/v2.0/users endpoint. An attacker can retrieve sensitive password hash and salt values by abusing the filtering capability to extract this information character by character. Note:...

CVE-2025-25245

SAP BusinessObjects Business Intelligence Platform Web Intelligence contains a deprecated web application endpoint that is not properly secured. An attacker could take advantage of this by injecting a malicious url in the data returned to the user. On successful exploitation, there could be a...

CVE-2025-25245 Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence)

SAP BusinessObjects Business Intelligence Platform Web Intelligence contains a deprecated web application endpoint that is not properly secured. An attacker could take advantage of this by injecting a malicious url in the data returned to the user. On successful exploitation, there could be a...

CVE-2025-25245

CVE-2025-25245 affects SAP BusinessObjects BI Platform (Web Intelligence). A deprecated web application endpoint that is not properly secured allows injection of a malicious URL via data returned to the user, enabling cross-site scripting within the victim’s browser. Impacts are limited to confid...

SAS Stored Process Web Application Cross-Site Scripting Vulnerability

The SAS Stored Process Web Application is a stored procedure web application from SAS. A cross-site scripting vulnerability exists in SAS Stored Process Web Application versions 9.4M7 and 9.4M8, which stems from a reflected cross-site scripting XSS vulnerability in the program parameter of the...

PT-2020-13198

Name of the Vulnerable Software and Affected Versions Progress MOVEit Automation Web Admin versions 2018 through 2018.0 prior to 2018.0.3 Progress MOVEit Automation Web Admin versions 2018 SP1 through 2018.2 prior to 2018.2.3 Progress MOVEit Automation Web Admin versions 2018 SP2 through 2018.3...