EUVD-2025-14823

Malicious code in bioql PyPI...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the zkClusterKey parameter, which is passed unescaped to an SQL query in executorCount. An attacker can execute arbitrary SQL commands by via the /console/dashboard/executorCount?zkClusterKey endpoint. Remediation Ther...

PT-2025-14546 · Vipshop · Saturn

Name of the Vulnerable Software and Affected Versions: vipshop Saturn versions 3.5.1 and earlier Description: The issue allows a remote attacker to execute arbitrary code. This can be achieved via the "/console/dashboard/executorCount" API endpoint, specifically by manipulating the zkClusterKey...