94229 matches found
PT-2026-102819
Name of the Vulnerable Software and Affected Versions bytebase dbhub version 1.2.0 Description An issue exists in the /utils/sql-parser.ts component that allows attackers to access sensitive database information by using a crafted SQL statement. This is a SQL injection, which occurs when an...
CVE-2026-79536: Improper Neutralization of Special Elements used in an SQL Command
bytebase dbhub v1.2.0 was discovered to contain a SQL injection vulnerability in the /utils/sql-parser.ts component. This vulnerability allows attackers to access sensitive databse information via a crafted SQL statement...
CVE-2026-79536
bytebase dbhub v1.2.0 was discovered to contain a SQL injection vulnerability in the /utils/sql-parser.ts component. This vulnerability allows attackers to access sensitive databse information via a crafted SQL statement...
PT-2026-102441
A vulnerability was detected in FastAdmin 1.6.1.20250430/1.6.5.20260602. This affects an unknown function of the file application/database.php of the component Database Management. The manipulation results in execution with unnecessary privileges. The attack may be launched remotely. The exploit ...
VulnCheck KEV: CVE-2023-54400
Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary SQL through the Name parameter of the getEmpByname action without any authentication. Attackers can exploit UNION-based SQL injection...
CVE-2026-71379: Files or Directories Accessible to External Parties
The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request...
CVE-2025-57819
CVE-2025-57819 - FreePBX 未认证远程代码执行 RCE CVE-2025-57819 是一个影响 Sangoma FreePBX 版本 15、16 和 17 的 严重远程代码执行 RCE 漏洞。该漏洞源于易受攻击端点中对用户控制输入的清理不足 ，使得未认证攻击者能够绕过认证、操纵应用程序的后端数据库，并最终在底层服务器上执行任意操作系统命令。 凭借 CVSS v3 评分 9.8（严重） ，该漏洞代表一个完整的入侵场景，不需要认证 ，不需要用户交互 。 技术摘要 属性| 值 ---|--- CVE| CVE-2025-57819 严重性| 严重 CVSS v3| 9....
CVE-2026-101092
SiYuan before v3.8.4 fails to enforce publish-access checks in the getCurrentAttrViewImages endpoint, allowing publish readers to retrieve image asset paths from unauthorized databases. Attackers can call the endpoint with an unrendered database identifier obtained through related endpoints to le...
DEBIAN-CVE-2024-58386
ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to outputfile, enabling attackers with Events view permission to access...
CVE-2024-58386
ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to outputfile, enabling attackers with Events view permission to access...
CVE-2024-58386
ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to outputfile, enabling attackers with Events view permission to access...
UBUNTU-CVE-2024-58386
ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to outputfile, enabling attackers with Events view permission to access...
CVE-2026-101092 SiYuan before v3.8.4 Information Disclosure via getCurrentAttrViewImages
SiYuan before v3.8.4 fails to enforce publish-access checks in the getCurrentAttrViewImages endpoint, allowing publish readers to retrieve image asset paths from unauthorized databases. Attackers can call the endpoint with an unrendered database identifier obtained through related endpoints to le...
CVE-2024-58386 ZoneMinder 1.37.x Path Traversal via files view
ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to outputfile, enabling attackers with Events view permission to access...
CVE-2024-58386 ZoneMinder 1.37.x Path Traversal via files view
ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to outputfile, enabling attackers with Events view permission to access...
CVE-2026-98122
A flaw was found in the Linux kernel's Virtual Extensible LAN VXLAN driver. A local unprivileged attacker can cause a denial of service DoS or potentially escalate privileges through memory corruption. This vulnerability occurs because the Multicast Database MDB subsystem improperly validates...
CVE-2026-12265
Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations...
WordPress File Manager plugin 7.2.2-8.0.4 - Unauthenticated Database Backup Disclosure vulnerability
Unauthenticated Database Backup Disclosure vulnerability discovered by Jakub Herman in WordPress Plugin File Manager versions 7.2.2-8.0.4...
CVE-2026-12265
Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to an insufficient access control flaw in the HA failover endpoint . This vulnerability allows an attacker to perform destructive PostgreSQL database operations , potentially leading to complete data destruction. The vulnerabil...
