CVE-2025-14603

The application component processes user-supplied parameters insecurely, passing them into SQL queries. This can enable blind SQL injection, potentially exposing database contents or causing the application to become unresponsive. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and...

CVE-2026-61518

ISPConfig contains an authenticated SQL injection vulnerability in its Remote API . The primary_id parameter passed to delete and update API methods is concatenated directly into SQL WHERE clauses without integer casting or parameterized query binding. The built-in SQL injection scanner does not ...

EUVD-2026-62663

ISPConfig contains an authenticated SQL injection vulnerability in the Remote API. The primaryid parameter passed to delete and update API methods is concatenated directly into SQL WHERE clauses without integer casting or parameterized query binding. The built-in SQL injection scanner does not...

CVE-2025-14603 Use of user input in raw SQL queries in vsDesk leading to blind SQL injection

The application component processes user-supplied parameters insecurely, passing them into SQL queries. This can enable blind SQL injection, potentially exposing database contents or causing the application to become unresponsive. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and...

CVE-2025-14603

vsDesk is vulnerable to blind SQL injection due to insecure handling of user-supplied parameters that are passed directly into SQL queries. An unauthenticated remote attacker can exploit this over the network with low complexity to potentially expose database contents or render the application un...

CVE-2025-14603 Use of user input in raw SQL queries in vsDesk leading to blind SQL injection

The application component processes user-supplied parameters insecurely, passing them into SQL queries. This can enable blind SQL injection, potentially exposing database contents or causing the application to become unresponsive. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and...

EUVD-2025-210741

The application component processes user-supplied parameters insecurely, passing them into SQL queries. This can enable blind SQL injection, potentially exposing database contents or causing the application to become unresponsive. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and...

CVE-2026-20327 Cisco Unified Intelligence Center SQL Injection Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL injection attack against an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker coul...

CVE-2026-20327

Cisco Unified Intelligence Center contains a blind SQL injection vulnerability in its web-based management interface , caused by insufficient validation of user-supplied input. An authenticated attacker with valid credentials can send a crafted request to read the contents of the device's interna...

Cisco Unified Intelligence Center SQL Injection Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL injection attack against an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker coul...

EUVD-2026-62403

Stigmem before 0.9.0a11 fails to validate the deliveryaddress parameter when creating webhook subscriptions, allowing authenticated users to specify internal loopback and private network destinations. Attackers can trigger matching fact-change events to cause the Stigmem server to issue server-si...

CVE-2026-76164

AIL Framework contains a server-side request forgery SSRF vulnerability in its crawler submission functionality. A low-privileged authenticated user with access to the crawler interface can submit an arbitrary URL for crawling without adequate validation of the destination host. The crawler can...

PT-2026-78543

Name of the Vulnerable Software and Affected Versions ISPConfig affected versions not specified Description An authenticated SQL injection exists in the Remote API. The primary id parameter used in delete and update API methods is concatenated directly into SQL WHERE clauses without integer casti...

PT-2026-78522

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL injection attack against an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker coul...

NPM: MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery

NPM: MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery vulnerability discovered by ? in WordPress Npm magicmirror versions 2.37.0...

CVE-2026-63642 MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, checkArticleUrl in defaultmodules/newsfeed/nodehelper.js accepts the CHECKARTICLEURL notification through the unauthenticated Socket.IO namespace /newsfeed and performs fetchurl, method: "HEAD" without validating the...

EUVD-2026-61072

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, checkArticleUrl in defaultmodules/newsfeed/nodehelper.js accepts the CHECKARTICLEURL notification through the unauthenticated Socket.IO namespace /newsfeed and performs fetchurl, method: "HEAD" without validating the...

CVE-2026-63642 MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, checkArticleUrl in defaultmodules/newsfeed/nodehelper.js accepts the CHECKARTICLEURL notification through the unauthenticated Socket.IO namespace /newsfeed and performs fetchurl, method: "HEAD" without validating the...

ANT-2026-REDYDMAE · supabase/supabase · xss

xss medium Severity Claude medium · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-REDYDMAE: DOM-based XSS via javascript: scheme in URL hostname check The isVercelUrl helper checks only that ne...

CVE-2026-50775

A blind SSRF attack in DataHub v.1.5.0.1 allows a remote attacker to execute arbitrary code via the server retrieving an image from a crafted URL, and it fails to return the content or any errors directly...