CVE-2017-16082

CVE-2017-16082 Overview Affected versions of pg contain a remote code execution vulnerability that occurs when the remote database or query specifies a crafted column name. There are two specific scenarios in which it is likely for an application to be vulnerable: 1. The application executes...

CVE-2024-23995

Beekeeper-Studio PoC A Proof-Of-Concept for CVE-2024-23995 vulnerability. 1.Vunerability Overview: Vulnerability Subject: RCE via XSS Vulnerability Version: = Beekeeper-Studio-4.1.13 Attack Type: Remote Code Execution Attack Vectors: To exploit the vulnerability, one must insert malicious scripts...

CVE-2026-123859

When identifier escaping is disabled through a non-default configuration, the writepandas data-loading functionality in the Snowflake Connector for Python and the Snowflake Connector for Python Universal Core did not escape DataFrame column names before including them in generated SQL, which coul...

EUVD-2026-118319

When identifier escaping is disabled through a non-default configuration, the writepandas data-loading functionality in the Snowflake Connector for Python and the Snowflake Connector for Python Universal Core did not escape DataFrame column names before including them in generated SQL, which coul...

CVE-2026-123859

The Snowflake Connector for Python and Snowflake Connector for Python (Universal Core) are vulnerable to SQL injection via the write_pandas() data-loading functionality. When identifier escaping is disabled through a non-default configuration, the software fails to escape DataFrame column names b...

CVE-2026-123859 SQL Injection via unescaped DataFrame column names in Snowflake Connector for Python and Snowflake Connector for Python (Universal Core)

When identifier escaping is disabled through a non-default configuration, the writepandas data-loading functionality in the Snowflake Connector for Python and the Snowflake Connector for Python Universal Core did not escape DataFrame column names before including them in generated SQL, which coul...

CVE-2026-123859 SQL Injection via unescaped DataFrame column names in Snowflake Connector for Python and Snowflake Connector for Python (Universal Core)

When identifier escaping is disabled through a non-default configuration, the writepandas data-loading functionality in the Snowflake Connector for Python and the Snowflake Connector for Python Universal Core did not escape DataFrame column names before including them in generated SQL, which coul...

CVE-2026-123859: Snowflake: When identifier escaping is disabled through a non-default configuration, the write_pandas() data-loading functionality…

When identifier escaping is disabled through a non-default configuration, the writepandas data-loading functionality in the Snowflake Connector for Python and the Snowflake Connector for Python Universal Core did not escape DataFrame column names before including them in generated SQL, which coul...

Rocky Linux 9 [CIQ] Security Update: postgresql-jdbc (crlsa-2023_0318)

The Rocky Linux 9 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20230318 advisory. postgresql: SQL Injection in ResultSet.refreshRow with malicious column names CVE-2022-31197 Tenable has extracted the preceding description block directly from the...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure in the getSortColumn process. An attacker can access sensitive database column names and manipulate the ordering of query results by supplying arbitrary values to the sort parameter, which are not validated against...

CVE-2026-18032

The WP Data Access WordPress plugin before 5.5.79 does not validate the column names it accepts on one of its unauthenticated AJAX actions, and the nonce guarding that action does not cover them, allowing unauthenticated attackers to read arbitrary columns of the database table the affected...

CVE-2017-20275

Joomla! Component PHP-Bridge 1.2.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send GET requests to index.php with option=comphpbridge&view=phpview parameters and...

CVE-2026-7299

Appsmith’s SQL query editor’s autocomplete functionality fails to sanitize database object names before rendering them in innerHTML, allowing an authenticated Developer to inject persistent XSS by a malicious table or column names triggering arbitrary code execution in the sessions of other...

CVE-2026-7299 CVE-2026-7299

Appsmith’s SQL query editor’s autocomplete functionality fails to sanitize database object names before rendering them in innerHTML, allowing an authenticated Developer to inject persistent XSS by a malicious table or column names triggering arbitrary code execution in the sessions of other...

CVE-2018-25428

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2018-25425

Yot CMS 3.3.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the aid and cid parameters. Attackers can send GET requests to index.php with crafted SQL payloads in the aid or cid parameters to extra...

CVE-2018-25411

CVE-2018-25411 affects MGB OpenSource Guestbook 0.7.0.2. The vulnerability is an SQL injection in the email.php endpoint vulnerable to crafted payloads via the id parameter, allowing unauthenticated attackers to execute arbitrary SQL and potentially enumerate database tables and columns. The issu...

MGB OpenSource Guestbook SQL Injection Vulnerability

MGB OpenSource Guestbook is an open-source web-based message board system developed by MGB OpenSource. Version 0.7.0.2 of MGB OpenSource Guestbook has a SQL injection vulnerability. This vulnerability arises from injecting malicious code through the id parameter, which may allow unauthenticated...

Yot CMS SQL injection vulnerability

Yot CMS is a content management system developed by Yot Corporation. Version 3.3.1 of Yot CMS has a SQL injection vulnerability. This vulnerability stems from the use of parameters named aid and cid, which can allow unauthorized attackers to execute arbitrary SQL queries by injecting malicious...

PT-2026-45125

Yot CMS 3.3.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the aid and cid parameters. Attackers can send GET requests to index.php with crafted SQL payloads in the aid or cid parameters to extra...