399147 matches found
CVE-2026-111634
Helical Insight through version 7.0.0 is vulnerable to a SQL injection flaw located at the /executeDatasource endpoint. The root cause is the use of unescaped report parameter values which allows attackers to bypass the SqlDetect guard . Authenticated viewers can exploit this by supplying crafted...
CVE-2026-111634 Helical Insight through 7.0.0 SQL Injection via /executeDatasource
Helical Insight through 7.0.0 contains an sql injection vulnerability that allows authenticated viewers to inject SQL through unescaped report parameter values sent to /executeDatasource. Attackers can supply crafted Numeric or String placeholder values that bypass the broken SqlDetect guard to...
CVE-2026-111634 Helical Insight through 7.0.0 SQL Injection via /executeDatasource
Helical Insight through 7.0.0 contains an sql injection vulnerability that allows authenticated viewers to inject SQL through unescaped report parameter values sent to /executeDatasource. Attackers can supply crafted Numeric or String placeholder values that bypass the broken SqlDetect guard to...
CVE-2026-111632 Aureus ERP through 1.6.0 Multi-Company Authorization Bypass via company_id
Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows authenticated API users to create or move records into disallowed companies by supplying a foreign companyid. Attackers can submit create or update requests to plugin REST API endpoints such as partners, sales, or...
EUVD-2026-103054
Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows authenticated API users to create or move records into disallowed companies by supplying a foreign companyid. Attackers can submit create or update requests to plugin REST API endpoints such as partners, sales, or...
CVE-2026-111632 Aureus ERP through 1.6.0 Multi-Company Authorization Bypass via company_id
Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows authenticated API users to create or move records into disallowed companies by supplying a foreign companyid. Attackers can submit create or update requests to plugin REST API endpoints such as partners, sales, or...
CVE-2026-111632 Aureus ERP through 1.6.0 Multi-Company Authorization Bypass via company_id
Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows authenticated API users to create or move records into disallowed companies by supplying a foreign companyid. Attackers can submit create or update requests to plugin REST API endpoints such as partners, sales, or...
CVE-2026-111632
Aureus ERP versions through 1.6.0 contain an authorization bypass vulnerability (CWE-639) that compromises multi-company data segregation. Authenticated API users can bypass restrictions to create or move records into unauthorized companies by providing a foreign company_id . This flaw specifical...
CVE-2026-111629
IoTSharp versions through 3.6.1 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in the Customers and Devices API handlers. The root cause is a failure to scope database queries to the caller's specific tenant, allowing any authenticated user to access data from other te...
CVE-2026-111629 IoTSharp through 3.6.1 Cross-Tenant Data Exposure via Customers and Devices APIs
IoTSharp through 3.6.1 contains an insecure direct object reference vulnerability that allows any authenticated user to read other tenants' data because Customers and Devices API handlers do not scope queries to the caller's tenant. Attackers can self-register through the anonymous...
CVE-2026-111629 IoTSharp through 3.6.1 Cross-Tenant Data Exposure via Customers and Devices APIs
IoTSharp through 3.6.1 contains an insecure direct object reference vulnerability that allows any authenticated user to read other tenants' data because Customers and Devices API handlers do not scope queries to the caller's tenant. Attackers can self-register through the anonymous...
CVE-2026-111629
IoTSharp through 3.6.1 contains an insecure direct object reference vulnerability that allows any authenticated user to read other tenants' data because Customers and Devices API handlers do not scope queries to the caller's tenant. Attackers can self-register through the anonymous...
CVE-2026-111629 IoTSharp through 3.6.1 Cross-Tenant Data Exposure via Customers and Devices APIs
IoTSharp through 3.6.1 contains an insecure direct object reference vulnerability that allows any authenticated user to read other tenants' data because Customers and Devices API handlers do not scope queries to the caller's tenant. Attackers can self-register through the anonymous...
EUVD-2026-103051
IoTSharp through 3.6.1 contains an insecure direct object reference vulnerability that allows any authenticated user to read other tenants' data because Customers and Devices API handlers do not scope queries to the caller's tenant. Attackers can self-register through the anonymous...
EUVD-2026-103035
AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbitrary database connections by supplying jdbcUrl and jdbcDriverClass values to the data-dts /jobJdbcDatasource/test endpoint. Attackers can supply a MySQL JDBC URL with...
CVE-2026-111613
Versions of AllData through 0.7.1 are vulnerable to an unauthenticated JDBC injection via the data-dts /jobJdbcDatasource/test endpoint. This vulnerability allows remote attackers to open arbitrary database connections by supplying malicious jdbcUrl and jdbcDriverClass values. Specifically, an at...
CVE-2026-111613 AllData through 0.7.1 Unauthenticated JDBC Injection via /jobJdbcDatasource/test
AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbitrary database connections by supplying jdbcUrl and jdbcDriverClass values to the data-dts /jobJdbcDatasource/test endpoint. Attackers can supply a MySQL JDBC URL with...
CVE-2026-111613
AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbitrary database connections by supplying jdbcUrl and jdbcDriverClass values to the data-dts /jobJdbcDatasource/test endpoint. Attackers can supply a MySQL JDBC URL with...
CVE-2026-111613 AllData through 0.7.1 Unauthenticated JDBC Injection via /jobJdbcDatasource/test
AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbitrary database connections by supplying jdbcUrl and jdbcDriverClass values to the data-dts /jobJdbcDatasource/test endpoint. Attackers can supply a MySQL JDBC URL with...
DEBIAN-CVE-2026-92262
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql50 bypass prefix is affected because it allows the mysql50 prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue wit...