96599 matches found
EUVD-2026-57740
Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticated SQL injection...
Cypher Injection
Apache Camel Neo4J component is vulnerable to Cypher Injection. The vulnerability is due to insufficient validation of property names in the CamelNeo4jMatchProperties map, where attacker-controlled property names are concatenated directly into Cypher queries, allowing attackers to inject arbitrar...
CVE-2026-18707
creationtimestamp| type| source ---|---|--- 2026-08-13 04:45:50+00:00| seen| https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities20260813...
CVE-2026-18701
creationtimestamp| type| source ---|---|--- 2026-08-13 04:45:36+00:00| seen| https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities20260813...
CVE-2026-18695
creationtimestamp| type| source ---|---|--- 2026-08-13 04:45:21+00:00| seen| https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities20260813...
PT-2026-71822
IBM i 7.6, 7.5, and 7.4 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database...
ProjectDiscovery Nuclei Templates SQL injection vulnerability
ProjectDiscovery Nuclei Templates contains an SQL injection vulnerability. This vulnerability stems from improper handling of the id parameter in GET requests on the commentList.asp endpoint. Unauthenticated remote attackers can inject arbitrary SQL statements and bypass the keyword blacklist by...
CVE-2026-73608: Missing Authorization
SiYuan's development branch endpoint introduced by commit 9b8e8956f, not present in v3.7.3 or master, patched in v3.7.4 contains a missing-authorization vulnerability in the /api/av/getAttributeViewSearchTarget endpoint. The route is registered with CheckAuth only and performs no authorization...
Linux Distros Unpatched Vulnerability : CVE-2026-14671
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Type confusion in PostgreSQL module refint allows an object creator to execute arbitrary code as the operating system user running the database. The fix for thi...
CVE-2026-28189: Improper Limitation of a Pathname to a Restricted Directory
Unauthenticated Arbitrary File Deletion in Participants Database = 2.7.8.4 versions...
CVE-2026-73670: Improper Neutralization of Special Elements used in an SQL Command
A CMS contains a SQL injection vulnerability in admin/dbdata.php at line 509 that allows authenticated administrators to inject arbitrary SQL into a SHOW COLUMNS FROM statement by supplying unsanitized input through the tablename GET or POST parameter. Attackers can perform table traversal,...
CVE-2026-16961: Improper Neutralization of Special Elements used in an SQL Command
IBM i 7.6, 7.5, and 7.4 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database...
PT-2026-71533
Name of the Vulnerable Software and Affected Versions Participants Database versions prior to 2.7.8.5 Description The Participants Database plugin for WordPress contains a flaw allowing unauthenticated attackers to delete arbitrary files on the server. This occurs due to insufficient file path...
CVE-2026-72853: Improper Neutralization of Special Elements used in an SQL Command
Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in identifiers. Attackers with write permission on a table with a double-quote in its name can inject SQL that executes as the datasource's...
PT-2026-71707
ASP-CMS contains a SQL injection vulnerability in the commentList.asp endpoint that allows unauthenticated remote attackers to inject arbitrary SQL by manipulating the id parameter in GET requests to the comment listing script. Attackers can bypass the application's keyword blocklist by...
PT-2026-71884
Name of the Vulnerable Software and Affected Versions FreePBX versions 16.0.0 through 16.0.10 FreePBX versions prior to 17.0.4 Description The missedcall module fails to properly escape or use bound parameters when inserting the inbound Caller ID name from SIP From headers into the missedcalllog...
CVE-2026-71469
creationtimestamp| type| source ---|---|--- 2026-08-12 23:01:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/637i7bpnm3hto 2026-08-13 08:00:46+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msx6gxhtfw2o...
GHSA-MG8Q-52J3-W5F8 Duplicate Advisory: Publish-access filter on renderAttributeView leaves related-database content unfiltered and fails open on non-block first columns
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-mfrj-v65r-979c. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 fail to properly filter related-database content in renderAttributeView, allowing...
GHSA-FXMW-RV85-5HWH Duplicate Advisory: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeration oracles (publish mode)
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5fhr-f75j-8wr9. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 fail to apply publish-access filtering to the getAttributeViewKeysByID endpoint, allowi...
Duplicate Advisory: Publish-access filter on renderAttributeView leaves related-database content unfiltered and fails open on non-block first columns
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-mfrj-v65r-979c. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 fail to properly filter related-database content in renderAttributeView, allowing...