35 matches found
EUVD-2026-107582
Laravel relationship inclusion can trigger unauthorized data destruction...
GHSA-5WCM-3V2W-8362 Laravel relationship inclusion can trigger unauthorized data destruction
A vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than simply retrieving data. Impact A user with only read access...
CVE-2026-114508
Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-tabl...
CVE-2026-114508 Laravel relationship inclusion can trigger unauthorized data destruction
Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-tabl...
CVE-2026-114508 Laravel relationship inclusion can trigger unauthorized data destruction
Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-tabl...
CVE-2026-114508 Laravel relationship inclusion can trigger unauthorized data destruction
Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-tabl...
CVE-2026-114508
Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-tabl...
CVE-2026-114508
The Laravel web application framework is vulnerable to unauthorized data destruction in versions 12.45.0 through 12.68.0 and 13.27.0 . The root cause is that crafted relationship inclusions on a read-only endpoint can trigger destructive database operations on related tables instead of retrieving...
PT-2026-120838
Name of the Vulnerable Software and Affected Versions Laravel versions 12.45.0 through 12.67.0 Laravel version 13.26.0 and earlier Description A crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. This...
EUVD-2026-91788
Multiple @opentelemetry/instrumentation- packages expose database username via unconditional db.user span attribute...
CVE-2026-33133: Improper Neutralization of Special Elements used in an SQL Command
WeGIA is a web manager for charitable institutions. In versions 3.6.5 and 3.6.6, the loadBackupDB function imports SQL files from uploaded backup archives without any content validation. An attacker can craft a backup archive containing arbitrary SQL statements that create rogue administrator...
Get-MonitorConfiguration returns an error after DDC/Site upgrade
When admin invokes a cmdlet: Get-MonitorConfiguration, the error is displayed: A database operation failed and could not be recovered : Reason ? CDF Control trace captured on the DDC shows the error: Monitor System Setting 'DisableGoogleAnalytics' exists in the database was loaded but not found i...
WordPress plugin “Find and Replace All” has a vulnerability related to cross-site request fraud.
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...
CVE-2021-22378
There is a race condition vulnerability in eCNS280TD V100R005C00 and V100R005C10. There is a timing window exists in which the database can be operated by another thread that is operating concurrently. Successful exploit may cause the affected device abnormal...
CVE-2019-12890
RedwoodHQ 2.5.5 does not require any authentication for database operations, which allows remote attackers to create admin users via a con.automationframework users insertone call...
HongCMS SQL Injection Vulnerability
HongCMS is an open source lightweight content management system CMS. An SQL injection vulnerability exists in the admin\controllers\database.php file in HongCMS version 3.0.0. Remote attackers can use admin/index.php/database/operate?dbaction=emptytable&tablename= URI to execute arbitrary SQL...
OpenText Document Sciences xPression 4.5SP1 Patch 13 SQL Injection Vulnerability
Exploit for java platform in category web applications Title: OpenText Document Sciences xPression formerly EMC Document Sciences xPression - SQL Injection Author: Marcin Woloszyn Date: 27. September 2017 CVE: CVE-2017-14758 Affected Software: ================== OpenText Document Sciences xPressi...
CVE-2017-12774
finecms in 1.9.5\controllers\member\ContentController.php allows remote attackers to operate website database...
