84859 matches found
EUVD-2025-210707
An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limited to the system’s notification...
CVE-2025-41771 SQL injection
An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limited to the system’s notification...
CVE-2025-41771
CVE-2025-41771 details an SQL injection vulnerability exploitable by an authenticated user with low privileges via an endpoint in the controller’s web interface. The flaw affects a SQLite database used solely for storing notification messages, so the impact is limited to the system’s notification...
CVE-2025-41771
An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limited to the system’s notification...
CVE-2026-18789
The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functionality, allowing unauthenticated attackers to trigger a server-side export of the site's database, including user password hashes and password reset tokens, as well as to persistently...
EUVD-2026-57102
The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functionality, allowing unauthenticated attackers to trigger a server-side export of the site's database, including user password hashes and password reset tokens, as well as to persistently...
CVE-2026-18789 Ezoic < 2.23.1 - Unauthenticated Database Export via Content Export REST Routes
The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functionality, allowing unauthenticated attackers to trigger a server-side export of the site's database, including user password hashes and password reset tokens, as well as to persistently...
CVE-2026-18789
The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functionality, allowing unauthenticated attackers to trigger a server-side export of the site's database, including user password hashes and password reset tokens, as well as to persistently...
CVE-2026-18789
The CVE-2026-18789 entry concerns the Ezoic WordPress plugin prior to version 2.23.1. The vulnerability arises from insufficient access restrictions on content export functionality exposed via REST routes, allowing unauthenticated attackers to trigger a server-side export of the site’s database (...
EUVD-2026-57091
The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for a database-backed choice field, allowing subscriber-level users to perform second-order SQL injection...
CVE-2026-16977
The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for a database-backed choice field, allowing subscriber-level users to perform second-order SQL injection...
Linux Distros Unpatched Vulnerability : CVE-2026-72558
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The...
PT-2026-71027
The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functionality, allowing unauthenticated attackers to trigger a server-side export of the site's database, including user password hashes and password reset tokens, as well as to persistently...
LiteLLM SQL injection vulnerability
LiteLLM is an open-source application developed by Berri AI. It allows for the invocation of all LLM APIs in the OpenAI format. LiteLLM has a SQL injection vulnerability, and attackers can exploit this vulnerability to obtain sensitive database information...
PT-2026-71233
SiYuan v3.7.4-alpha.1 a pre-release; the endpoint does not exist in stable v3.7.3 or earlier contains an information disclosure vulnerability in the /api/av/getAttributeViewFieldViews endpoint. The route is registered with CheckAuth only and applies no publish-access filtering, so reader-role...
Metabase 0.58.x < 0.58.24 / 0.59.x < 0.59.21 / 0.60.x < 0.60.17 / 0.61.x < 0.61.11 / 0.62.x < 0.62.9 / 0.63.x < 0.63.5 / 1.58.x < 1.58.24 / 1.59.x < 1.59.21 / 1.60.x < 1.60.17 / 1.61.x < 1.61.11 / 1.62.x < 1.62.9 / 1.63.x < 1.63.5 Multiple Vulnerabilities
The version of Metabase installed on the remote host is 0.58.x prior to 0.58.24, 0.59.x prior to 0.59.21, 0.60.x prior to 0.60.17, 0.61.x prior to 0.61.11, 0.62.x prior to 0.62.9, 0.63.x prior to 0.63.5, 1.58.x prior to 1.58.24, 1.59.x prior to 1.59.21, 1.60.x prior to 1.60.17, 1.61.x prior to...
PT-2026-71038
An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limited to the system’s notification...
PT-2026-71115
Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user customer, reseller to execute arbitrary code on behalf of the database server administrator...
CVE-2026-62901
Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment,...
CVE-2026-53413
creationtimestamp| type| source ---|---|--- 2026-08-11 19:30:25+00:00| seen| https://bsky.app/profile/hendryadrian.bsky.social/post/3mste2cxxxs2i 2026-08-11 19:39:32+00:00| seen| https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mstekmt5rz2z 2026-08-11 23:11:02+00:00| seen|...