CVE-2026-42208

✦ CVE-2026-42208 - Iniezione SQL Critica in LiteLLM 🧭 Panoramica CVE-2026-42208 è una vulnerabilità critica di iniezione SQL pre-autenticazione che colpisce il gateway AI LiteLLM. Consente agli attaccanti di sfruttare le query del database backend senza autenticazione , esponendo potenzialmente...

CVE-2025-57819

CVE-2025-57819 - FreePBX 未认证远程代码执行 RCE CVE-2025-57819 是一个影响 Sangoma FreePBX 版本 15、16 和 17 的 严重远程代码执行 RCE 漏洞。该漏洞源于易受攻击端点中对用户控制输入的清理不足 ，使得未认证攻击者能够绕过认证、操纵应用程序的后端数据库，并最终在底层服务器上执行任意操作系统命令。 凭借 CVSS v3 评分 9.8（严重） ，该漏洞代表一个完整的入侵场景，不需要认证 ，不需要用户交互 。 技术摘要 属性| 值 ---|--- CVE| CVE-2025-57819 严重性| 严重 CVSS v3| 9....

CVE-2026-79763

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.0 until 2.5.1, the POST /users/totp/disable and POST /users/totp/backup-codes endpoints accept the account password as the sole reauthentication factor after a 2.4.0 refactor...

CVE-2026-79764 Termix: Authenticated SSRF via `/homepage/proxy` — No Destination Allowlist

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.5.0 until 2.5.1, the /homepage/proxy endpoint accepts an authenticated user's url query parameter and passes it to http.get or https.get without destination restrictions. In...

CVE-2026-79761 Termix: Command injection in SSH key deployment verification

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the Termix SSH key deployment flow derives a grep pattern from a user-controlled public-key token and interpolates it into double-quoted shell commands executed on...

CVE-2026-79761 Termix: Command injection in SSH key deployment verification

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the Termix SSH key deployment flow derives a grep pattern from a user-controlled public-key token and interpolates it into double-quoted shell commands executed on...

CVE-2026-79761 Termix: Command injection in SSH key deployment verification

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the Termix SSH key deployment flow derives a grep pattern from a user-controlled public-key token and interpolates it into double-quoted shell commands executed on...

CVE-2026-79760 Termix: Authenticated blind SSRF through notification channel test endpoints

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.5.0 until 2.5.1, Termix allows authenticated users to configure webhook or ntfy notification channels with attacker-controlled destination URLs and trigger server-side requests...

CVE-2026-79761: Improper Neutralization of Special Elements used in an OS Command

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the Termix SSH key deployment flow derives a grep pattern from a user-controlled public-key token and interpolates it into double-quoted shell commands executed on...

PT-2026-94004

Name of the Vulnerable Software and Affected Versions Cisco ISE affected versions not specified Description Insufficient validation of certain parameters concatenated into SQL queries in the APIs allows an authenticated remote attacker with administrative credentials to perform SQL injection...

CVE-2026-63037: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This appears to allow SQL injection in the ORDER BY clause against the Manager backend database. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgra...

CVE-2026-7769

IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.52, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.52, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 is vulnerable to SQL injection. A remote attacker could send specially crafte...

EUVD-2026-43593

SAP S/4HANA application Project Management PPM-PRO allows an attacker with high privileges to execute crafted database queries, exposing the backend database. This results in low impact on confidentiality, with no impact on integrity and availability of the application...

CVE-2026-44769

CVE-2026-44769 affects SAP S/4HANA Project Management (PPM-PRO). The connected documents describe a vulnerability where an attacker with high privileges can induce crafted database queries, resulting in exposure of the backend database. The impact is specified as low for confidentiality (C:H) wit...

CVE-2026-44769

SAP S/4HANA application Project Management PPM-PRO allows an attacker with high privileges to execute crafted database queries, exposing the backend database. This results in low impact on confidentiality, with no impact on integrity and availability of the application...

PT-2026-57945

SAP S/4HANA application Project Management PPM-PRO allows an attacker with high privileges to execute crafted database queries, exposing the backend database. This results in low impact on confidentiality, with no impact on integrity and availability of the application...

CVE-2026-48774

A flaw was found in ProxySQL, specifically within its GenAI/MCP MySQL Proxy Control Plane runsqlreadonly tool. This tool, designed for read-only operations, inadequately validates SQL statements. An attacker can exploit this by submitting a seemingly read-only initial SQL statement followed by a...

EUVD-2026-35387

SQL injection in the ‘twostepsauthcode’ parameter processed by the ‘twoStepsAuthVerification’ function within the ‘/user-login’ endpoint. The two-factor authentication 2FA functionality can be accessed without prior authentication, allowing unauthenticated attackers to execute arbitrary SQL queri...

IBM Cloud Pak for Data System SQL注入漏洞

IBM Cloud Pak for Data System is an enterprise data and AI integration platform provided by IBM. Version 11.3.0.2 of IBM Cloud Pak for Data System, as well as the Interim Fix 002, contain a SQL injection vulnerability. This vulnerability allows for SQL injection attacks, potentially enabling remo...

PT-2026-43282

Name of the Vulnerable Software and Affected Versions IBM Cloud Pak for Data System - Cyclops versions 11.3.0.2 through Interim Fix 002 Description SQL injection allows a remote attacker to send specially crafted SQL statements to the system. This could enable the attacker to view, add, modify, o...