EUVD-2025-14823

Malicious code in bioql PyPI...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the zkClusterKey parameter, which is passed unescaped to an SQL query in executorCount. An attacker can execute arbitrary SQL commands by via the /console/dashboard/executorCount?zkClusterKey endpoint. Remediation Ther...

CVE-2025-29085

SQL injection vulnerability in vipshop Saturn v.3.5.1 and before allows a remote attacker to execute arbitrary code via /console/dashboard/executorCount?zkClusterKey component...

CVE-2025-29085: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in vipshop Saturn v.3.5.1 and before allows a remote attacker to execute arbitrary code via /console/dashboard/executorCount?zkClusterKey component...

PT-2025-14546 · Vipshop · Saturn

Name of the Vulnerable Software and Affected Versions: vipshop Saturn versions 3.5.1 and earlier Description: The issue allows a remote attacker to execute arbitrary code. This can be achieved via the "/console/dashboard/executorCount" API endpoint, specifically by manipulating the zkClusterKey...