94672 matches found
EUVD-2026-58486
FreePBX is an open source IP PBX. From 16.0.0 until 16.0.11 and 17.0.4, the FreePBX missedcall module places the inbound Caller ID name from crafted SIP From headers into the missedcalllog INSERT in agi-bin/missedcallnotify.php without escaping or bound parameters. An unauthenticated caller can...
CVE-2026-73663
FreePBX is an open source IP PBX. From 16.0.0 until 16.0.11 and 17.0.4, the FreePBX missedcall module places the inbound Caller ID name from crafted SIP From headers into the missedcalllog INSERT in agi-bin/missedcallnotify.php without escaping or bound parameters. An unauthenticated caller can...
Exploit for SQL Injection in Metabase
CVE-2026-72898...
CVE-2026-16961
IBM i 7.6, 7.5, and 7.4 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database...
CVE-2026-16961
IBM i 7.6, 7.5, and 7.4 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database...
CVE-2026-16961 IBM i is Affected By SQL Injection Vulnerability in Db2 Mirror []
IBM i 7.6, 7.5, and 7.4 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database...
EUVD-2026-58381
IBM i 7.6, 7.5, and 7.4 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database...
CVE-2019-25765
creationtimestamp| type| source ---|---|--- 2026-08-13 18:46:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/eio7hnpnmjbon 2026-08-14 14:00:30+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/b6890fd9-837f-4a64-a1fa-c036ecba0806 2026-08-30...
CVE-2026-73651 TypeORM: migration:generate template-literal code injection
TypeORM is a TypeScript and JavaScript ORM for Node.js that supports PostgreSQL, MySQL, MariaDB, SQLite, SQL Server, Oracle, and other databases. Prior to versions 0.3.31 and 1.1.0, typeorm migration:generate embeds database schema metadata into JavaScript or TypeScript template literals in...
GHSA-48P8-G2FX-3WWM
creationtimestamp| type| source ---|---|--- 2026-08-13 17:32:46+00:00| seen| https://gist.github.com/alon710/ee760ed8dd4e3944f68b62f514473cdc...
CVE-2019-25765
ASP-CMS contains a SQL injection vulnerability in the commentList.asp endpoint that allows unauthenticated remote attackers to inject arbitrary SQL by manipulating the id parameter in GET requests to the comment listing script. Attackers can bypass the application's keyword blocklist by...
CVE-2026-71287
A flaw was found in Cacti. An authenticated user, regardless of their privilege level, can exploit a vulnerability where user-supplied input for sorting database columns is not properly sanitized. This allows for the injection of malicious SQL commands, leading to time-based blind SQL injection...
Unsafe Dependency Resolution
Overview Affected versions of this package are vulnerable to Unsafe Dependency Resolution via the \unrestrict meta-command input expansion in the restore process. An attacker can execute arbitrary code as the client operating system account by injecting malicious input from a compromised origin...
CVE-2026-73514 PostGIS address_standardizer Out-of-Bounds Write via standardize_address()
The addressstandardizer extension for PostGIS through 3.7.0, fixed in commit 423570b, contains an out-of-bounds write vulnerability that allows a database user with the ability to supply caller-controlled relation names to standardizeaddress to trigger memory corruption by providing a rules table...
CVE-2026-66430
Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.10 versions...
CVE-2026-28189
Unauthenticated Arbitrary File Deletion in Participants Database = 2.7.8.4 versions...
SQL Injection
Overview pimcore/pimcore is a content & product management framework CMS/PIM/E-Commerce. Affected versions of this package are vulnerable to SQL Injection via improper validation of class definition UIDs and unquoted concatenation of class IDs in SQL queries. An attacker can access sensitive...
CVE-2026-66658
Subscriber SQL Injection in Reviewer = 3.14.2 versions...
CVE-2026-66658
CVE-2026-66658 affects WordPress Reviewer plugin versions ≤ 3.14.2. The issue is described as a SQL Injection vulnerability (Subscriber SQL Injection) with CVSS 3.1, base score 8.5 (HIGH), vector: NETWORK/attackVector N, AC:L, PR:L, UI:N, S:C, C:H, I:N, A:L. Connected sources include CVE records ...