87101 matches found
CVE-2026-25554
A flaw was found in OpenSIPS. The authjwt module, when configured with dbmode and a SQL database backend, contains a SQL injection vulnerability in the jwtdbauthorize function. This function extracts the tag claim from a JSON Web Token JWT without verifying its signature and directly incorporates...
CVE-2026-25746 OpenEMR has SQL Injection Vulnerability
OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0 contain a SQL injection vulnerability in prescription that can be exploited by authenticated attackers. The vulnerability exists due to insufficient input validation in...
CVE-2026-25746 OpenEMR has SQL Injection Vulnerability
OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0 contain a SQL injection vulnerability in prescription that can be exploited by authenticated attackers. The vulnerability exists due to insufficient input validation in...
EUVD-2026-8714
OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0 contain a SQL injection vulnerability in prescription that can be exploited by authenticated attackers. The vulnerability exists due to insufficient input validation in...
CVE-2026-3221
Sensitive user account information is not encrypted in the database in Devolutions Server 2025.3.14 and earlier, which allows an attacker with access to the database to obtain sensitive user information via direct database access...
CVE-2026-3221
Devolutions Server versions 2025.3.14 and earlier are vulnerable because sensitive user account information is not encrypted in the database. This allows an attacker with direct database access to obtain sensitive user information. To address this, users should update to a version of Devolutions ...
CVE-2026-3221
Sensitive user account information is not encrypted in the database in Devolutions Server 2025.3.14 and earlier, which allows an attacker with access to the database to obtain sensitive user information via direct database access...
@bgord/bun (1.10.16), @ottocode/database (>=0.1.303, <=0.1.320) +5 more potentially affected by CVE-2026-27700 via hono (>=4.12.0, <=4.12.1)
hono NPM version =4.12.0, =0.1.303, =0.1.303, =0.1.303, =0.1.303, =2.2.0, =0.2.11, =0.2.51 Source cves: CVE-2026-27700 Source advisory: SNYK:JS-HONO-15353409...
CVE-2026-23627 OpenEMR has SQL Injection in Immunization Search/Report
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an SQL injection vulnerability in the Immunization module allows any authenticated user to execute arbitrary SQL queries, leading to complete database compromise, PHI...
EUVD-2026-8700
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an SQL injection vulnerability in the Immunization module allows any authenticated user to execute arbitrary SQL queries, leading to complete database compromise, PHI...
CVE-2026-23627 OpenEMR has SQL Injection in Immunization Search/Report
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an SQL injection vulnerability in the Immunization module allows any authenticated user to execute arbitrary SQL queries, leading to complete database compromise, PHI...
CVE-2026-23627
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an SQL injection vulnerability in the Immunization module allows any authenticated user to execute arbitrary SQL queries, leading to complete database compromise, PHI...
CVE-2026-23627 OpenEMR has SQL Injection in Immunization Search/Report
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an SQL injection vulnerability in the Immunization module allows any authenticated user to execute arbitrary SQL queries, leading to complete database compromise, PHI...
CVE-2026-25554 OpenSIPS 3.1 <= 3.6.4 auth_jwt SQL Injection Enables JWT Authentication Bypass
OpenSIPS versions 3.1 before 3.6.4 containing the authjwt module prior to commit 3822d33 contain a SQL injection vulnerability in the jwtdbauthorize function in modules/authjwt/authorize.c when dbmode is enabled and a SQL database backend is used. The function extracts the tag claim from a JWT...
CVE-2026-25554 OpenSIPS 3.1 <= 3.6.4 auth_jwt SQL Injection Enables JWT Authentication Bypass
OpenSIPS versions 3.1 before 3.6.4 containing the authjwt module prior to commit 3822d33 contain a SQL injection vulnerability in the jwtdbauthorize function in modules/authjwt/authorize.c when dbmode is enabled and a SQL database backend is used. The function extracts the tag claim from a JWT...
CVE-2026-25554
OpenSIPS versions 3.1 before 3.6.4 containing the authjwt module prior to commit 3822d33 contain a SQL injection vulnerability in the jwtdbauthorize function in modules/authjwt/authorize.c when dbmode is enabled and a SQL database backend is used. The function extracts the tag claim from a JWT...
CVE-2026-27847
Due to improper neutralization of special elements, SQL statements can be injected via the handshake of a TLS-SRP connection. This can be used to inject known credentials into the database that can be utilized to successfully complete the handshake and use the protected service. This issue affect...
CVE-2025-13776
Multiple Finka programs use hard-coded Firebird database credentials shared across all instances of this software. A malicious attacker in local network who knows default credentials is able to read and edit database content. This vulnerability has been fixed in version: Finka-FK 18.5, Finka-KPR...
CVE-2026-27847
The Linksys MR9600 (version 1.0.4.205530 ) and Linksys MX4200 (version 1.0.13.210200 ) are vulnerable to an SQL injection flaw caused by the improper neutralization of special elements during the TLS-SRP connection handshake . An attacker can inject SQL statements to introduce known credentials i...
