VulnCheck KEV: CVE-2023-54400

Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary SQL through the Name parameter of the getEmpByname action without any authentication. Attackers can exploit UNION-based SQL injection...

CVE-2026-79536

bytebase dbhub v1.2.0 was discovered to contain a SQL injection vulnerability in the /utils/sql-parser.ts component. This vulnerability allows attackers to access sensitive databse information via a crafted SQL statement...

CVE-2026-79536: Improper Neutralization of Special Elements used in an SQL Command

bytebase dbhub v1.2.0 was discovered to contain a SQL injection vulnerability in the /utils/sql-parser.ts component. This vulnerability allows attackers to access sensitive databse information via a crafted SQL statement...

CVE-2023-54400: Improper Neutralization of Special Elements used in an SQL Command

Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary SQL through the Name parameter of the getEmpByname action without any authentication. Attackers can exploit UNION-based SQL injection...

CVE-2026-102570: Improper Neutralization of Special Elements used in an SQL Command

ClipBucket v5 through 5.5.3-197 contains a time-based blind SQL injection vulnerability in the language update function where the languageid parameter is concatenated unescaped into the WHERE clause of an UPDATE statement. An authenticated administrator with basicsettings permission can inject...

CVE-2026-102569: Improper Neutralization of Special Elements used in an SQL Command

ClipBucket v5 through 5.5.3-197 contains a time-based blind SQL injection vulnerability in the admin video edit function where the videoid parameter is concatenated into an UPDATE statement without proper escaping. An authenticated administrator with videomoderation permission can inject arbitrar...

CVE-2015-20122: Improper Neutralization of Special Elements used in an SQL Command

Seeyon A6 collaborative office automation platform contains an unauthenticated SQL injection vulnerability in the attachids parameter of the file attachment download endpoint that allows remote attackers to extract arbitrary database contents without prior authentication. Attackers can inject...

CVE-2026-102247: Execution with Unnecessary Privileges

A vulnerability was detected in FastAdmin 1.6.1.20250430/1.6.5.20260602. This affects an unknown function of the file application/database.php of the component Database Management. The manipulation results in execution with unnecessary privileges. The attack may be launched remotely. The exploit ...

PT-2026-102643

Cleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and earlier allows an attacker with read access to the database to obtain external identity provider tokens and active session identifiers via direct inspection of stored records...

PT-2026-102628

ClipBucket v5 through 5.5.3-197 contains a time-based blind SQL injection vulnerability in the language update function where the language id parameter is concatenated unescaped into the WHERE clause of an UPDATE statement. An authenticated administrator with basic settings permission can inject...

PT-2026-102631

Seeyon A6 collaborative office automation platform contains an unauthenticated SQL injection vulnerability in the attach ids parameter of the file attachment download endpoint that allows remote attackers to extract arbitrary database contents without prior authentication. Attackers can inject...

PT-2026-102627

🚨 CVE-2026-102569 ClipBucket v5 through 5.5.3-197 contains a time-based blind SQL injection vulnerability in the admin video edit function where the videoid parameter is concatenated into an UPDATE statement without proper escaping. An authenticated administrator with video moderation permission...

PT-2026-102907

Name of the Vulnerable Software and Affected Versions Toptech TMS7 versions prior to 7.8 Description An unauthenticated attacker can export arbitrary database tables by sending a crafted POST request to the file export endpoint. Recommendations Upgrade Toptech TMS7 to version 7.8...

PT-2026-102441

A vulnerability was detected in FastAdmin 1.6.1.20250430/1.6.5.20260602. This affects an unknown function of the file application/database.php of the component Database Management. The manipulation results in execution with unnecessary privileges. The attack may be launched remotely. The exploit ...

PT-2026-102819

Name of the Vulnerable Software and Affected Versions bytebase dbhub version 1.2.0 Description An issue exists in the /utils/sql-parser.ts component that allows attackers to access sensitive database information by using a crafted SQL statement. This is a SQL injection, which occurs when an...

CVE-2025-57819

CVE-2025-57819 - FreePBX 未认证远程代码执行 RCE CVE-2025-57819 是一个影响 Sangoma FreePBX 版本 15、16 和 17 的 严重远程代码执行 RCE 漏洞。该漏洞源于易受攻击端点中对用户控制输入的清理不足 ，使得未认证攻击者能够绕过认证、操纵应用程序的后端数据库，并最终在底层服务器上执行任意操作系统命令。 凭借 CVSS v3 评分 9.8（严重） ，该漏洞代表一个完整的入侵场景，不需要认证 ，不需要用户交互 。 技术摘要 属性| 值 ---|--- CVE| CVE-2025-57819 严重性| 严重 CVSS v3| 9....

CVE-2026-101092

SiYuan before v3.8.4 fails to enforce publish-access checks in the getCurrentAttrViewImages endpoint, allowing publish readers to retrieve image asset paths from unauthorized databases. Attackers can call the endpoint with an unrendered database identifier obtained through related endpoints to le...

DEBIAN-CVE-2024-58386

ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to outputfile, enabling attackers with Events view permission to access...

CVE-2024-58386

ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to outputfile, enabling attackers with Events view permission to access...

CVE-2024-58386

ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to outputfile, enabling attackers with Events view permission to access...