116 matches found
CVE-2026-15018 Database Collation Fix <= 1.2.10 - Unauthenticated SQL Injection via 'force-collation-algorithm' Parameter
The Database Collation Fix plugin for WordPress is vulnerable to time-based SQL Injection via the 'force-collation-algorithm' parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
CVE-2026-15018
CVE-2026-15018 concerns the WordPress plugin “Database Collation Fix” (
CVE-2026-15018
The Database Collation Fix plugin for WordPress is vulnerable to time-based SQL Injection via the 'force-collation-algorithm' parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
PT-2026-67057
The Database Collation Fix plugin for WordPress is vulnerable to time-based SQL Injection via the 'force-collation-algorithm' parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
CVE-2026-15018: Improper Neutralization of Special Elements used in an SQL Command
The Database Collation Fix plugin for WordPress is vulnerable to time-based SQL Injection via the 'force-collation-algorithm' parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
Poweradmin: OIDC `sub` collation bypass in Poweradmin leading to account takeover
Preface Poweradmin maps OIDC identities into local users through oidcuserlinks.oidcsubject plus providerid. In the MySQL schema, the OIDC link table explicitly uses utf8mb4unicodeci, which is case-insensitive and accent-insensitive. OIDC sub is a stable external subject identifier and should be...
Improper Authentication
Overview Affected versions of this package are vulnerable to Improper Authentication in the authentication process when handling OIDC subject identifiers due to the use of an accent-insensitive collation in the database. An attacker can gain unauthorized access to another user's account by...
GHSA-CMWH-G2H8-C222 Poweradmin: OIDC `sub` collation bypass in Poweradmin leading to account takeover
Preface Poweradmin maps OIDC identities into local users through oidcuserlinks.oidcsubject plus providerid. In the MySQL schema, the OIDC link table explicitly uses utf8mb4unicodeci, which is case-insensitive and accent-insensitive. OIDC sub is a stable external subject identifier and should be...
Apollo ConfigService access key authentication bypass via appId parsing and non-canonical matching
Summary Apollo ConfigService may allow unauthorized access to configuration data when AccessKey / management key authentication is enabled and ConfigService accepts a non-canonical appId variant during authentication while downstream request handling resolves it to the protected app. Details...
PT-2026-58947
Summary Apollo ConfigService may allow unauthorized access to configuration data when AccessKey / management key authentication is enabled and ConfigService accepts a non-canonical appId variant during authentication while downstream request handling resolves it to the protected app. Details...
CVE-2026-55170 OpenFGA MySQL backend: case-insensitive collation on identifier columns causes incorrect authorization decisions
OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, when MySQL is being used as the datastore and authorization decisions rely on case-sensitive user strings, the tuple, changelog, and authorizationmodel identifier columns can compare case-distinct values such as...
CVE-2026-55170 OpenFGA MySQL backend: case-insensitive collation on identifier columns causes incorrect authorization decisions
OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, when MySQL is being used as the datastore and authorization decisions rely on case-sensitive user strings, the tuple, changelog, and authorizationmodel identifier columns can compare case-distinct values such as...
CVE-2026-55170
OpenFGA Open Source CVE-2026-55170 affects the MySQL datastore when decisions rely on case-sensitive user strings. The tuple, changelog, and authorization_model identifier columns can treat case-distinct values (e.g., user:Alice vs user:alice) as equivalent, potentially causing two distinct check...
social-auth-app-django affected by Improper Handling of Case Sensitivity
ImpactDue to default case-insensitive collation in MySQL or MariaDB databases, third-party authentication user IDs are not case-sensitive and could cause different IDs to match. PatchesThis issue has been addressed by https://github.com/python-social-auth/social-app-django/pull/566 and fix releas...
Improper Handling of Case Sensitivity
Overview Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity in authorization checks. A user can obtain an authorization decision meant for a different identity by issuing a check for a user string that differs only in letter case from an authorized one,...
EUVD-2015-3458
Malware in sbrugna...
EUVD-2012-3312
Malware in sbrugna...
EUVD-2023-28061
Malicious code in bioql PyPI...