nodejs: Node.js node:sqlite: Unintended data modification due to stale statement iterator

A flaw was found in Node.js's node:sqlite module. This vulnerability allows a previously used database statement, which should have been reset, to be re-executed with new parameters. This could lead to unintended data modifications or integrity issues within the application...

CVE-2025-69945

kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /doctor/edit-patient.php?editid=1...

CVE-2025-69942

kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /hms/doctor/view-patient.php?viewid=1...

CVE-2026-67433

Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring systems. In version 6.0.0, the logfile check legacy database migration moved a predictable path from /tmp with os.rename and allowed a local user controlling the plugin account to place a...

EUVD-2026-50494

DriveLock SQL Injection Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of DriveLock. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP por...

CVE-2026-5490

CVE-2026-5490 involves DriveLock where the web service (listening on TCP 4568 by default) constructs SQL queries from unvalidated user input, leading to a SQL Injection that can escalate privileges. The vulnerability is network-accessible and requires authentication to exploit, with impact descri...

vulnlab-platform-lab

Local VulnLab Platform The Local VulnLab Platform is a vulner...

EUVD-2026-50407

A SQL injection vulnerability exists in the Coverity Connect SOAP API for versions between 2024.6.0 and 2026.3.0 inclusive. A malicious, authenticated threat actor who sends a specially crafted payload can achieve full read access to database contents and other unauthorized commands...

CVE-2026-66724

MWDB Core versions 2.0.0 to 2.18.x contain a missing authorization vulnerability in deprecated config and blob upload endpoints. The undocumented POST method bypasses capability checks that apply to the documented PUT method, allowing any authenticated user without adding_configs or adding_blobs ...

CVE-2026-44943

An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in open-iscsi allows remote MITM attackers to create root-owned files outside the database and inject lines into the record. This issue affects open-iscsi: from through...

EUVD-2026-50311

An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in open-iscsi allows remote MITM attackers to create root-owned files outside the database and inject lines into the record. This issue affects open-iscsi: from through...

CVE-2026-44943 remote limited file-write as root via discovery in open-iscsi

An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in open-iscsi allows remote MITM attackers to create root-owned files outside the database and inject lines into the record. This issue affects open-iscsi: from through...

CVE-2026-33385 Blind SQL Injection in Quick.CMS

A Blind SQL injection vulnerability has been identified in Quick.CMS. Improper neutralization of input provided by a high-privileged user into multiple fields in administration panel allows for Blind SQL Injection attacks. The vendor states that this administration panel already allows for...

EUVD-2026-50310

A Blind SQL injection vulnerability has been identified in Quick.CMS. Improper neutralization of input provided by a high-privileged user into multiple fields in administration panel allows for Blind SQL Injection attacks. The vendor states that this administration panel already allows for...

CVE-2026-33385

Quick.CMS 6.8 is affected by a Blind SQL injection in the administration panel, resulting from improper neutralization of input fields accessed by a high-privileged user. The vulnerability can bypass front-end validation controls and potentially lead to database destruction. The CVSS-derived metr...

CVE-2026-33385 Blind SQL Injection in Quick.CMS

A Blind SQL injection vulnerability has been identified in Quick.CMS. Improper neutralization of input provided by a high-privileged user into multiple fields in administration panel allows for Blind SQL Injection attacks. The vendor states that this administration panel already allows for...

CVE-2026-50641

Streamsoft Business Intelligence BI stores users' passwords in plaintext form in the database This issue was fixed in version 6.8.0.0, users were also requested to change their password on the first login...

CVE-2026-12895 SQL Injection in Frappe's ERPNext

SQL injection in Frappe's ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2. The application constructs SQL queries through direct string interpolation using str.format without employing parameterized queries, allowing the name docname of a Supplier record containing SQL metacharacters to be...

CVE-2026-12895

SQL injection in Frappe's ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2. The application constructs SQL queries through direct string interpolation using str.format without employing parameterized queries, allowing the name docname of a Supplier record containing SQL metacharacters to be...

CVE-2026-58175 Apache Traffic Server: HostDB SRV handling leaks memory

Apache Traffic Server leaks memory when handling HostDB SRV records. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue...