SQL Injection

modsecurity-crs:sid is vulnerable to SQL injection. An authenticated attacker is able to inject and execute arbitrary SQL commands in the database through comment characters and variable assignments in the SQL syntax...

CVE-2020-22669: Improper Neutralization of Special Elements used in an SQL Command

Modsecurity owasp-modsecurity-crs 3.2.0 Paranoia level at PL1 has a SQL injection bypass vulnerability. Attackers can use the comment characters and variable assignments in the SQL syntax to bypass Modsecurity WAF protection and implement SQL injection attacks on Web applications...

CVE-2019-17123: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The eGain Web Email API 11+ allows spoofed messages because the fromName and message fields to /system/ws/v11/ss/email are mishandled, as demonstrated by fromName header injection with a %0a or %0d character. Also, the message parameter can have initial HTML comment characters...