OpenSky Flight Planning SQL Injection

The vulnerability of the OpenSky flight planning and operational management system lies in the lack of measures taken to protect the SQL query structure when processing the folderid parameter. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

CVE-2026-1177

A weakness has been identified in Yonyou KSOA 9.0. Affected by this vulnerability is an unknown functionality of the file /kmf/savefolder.jsp of the component HTTP GET Parameter Handler. Executing a manipulation of the argument folderid can lead to sql injection. It is possible to launch the atta...

CVE-2026-1133

A vulnerability was determined in Yonyou KSOA 9.0. The impacted element is an unknown function of the file /kmf/folder.jsp of the component HTTP GET Parameter Handler. Executing a manipulation of the argument folderid can lead to sql injection. The attack can be launched remotely. The exploit has...

SingleStore: Delete any folder for any user within the organization

A vulnerability in the SingleStore backend API allowed low-privileged users to delete folders belonging to other users within the same organization by manipulating the folderid parameter in DELETE requests. The vulnerability was rated CVSS 3.0 Low 3.8 due to high attack complexity requiring...

CVE-2021-24919

The Wicked Folders WordPress plugin before 2.8.10 does not sanitise and escape the folderid parameter before using it in a SQL statement in the wickedfolderssavesortorder AJAX action, available to any authenticated user. leading to an SQL injection...

PT-2015-4228

Name of the Vulnerable Software and Affected Versions Open-Xchange OX AppSuite and Server versions prior to 7.4.2-rev42 Open-Xchange OX AppSuite and Server version 7.6.0 prior to 7.6.0-rev36 Open-Xchange OX AppSuite and Server version 7.6.1 prior to 7.6.1-rev14 Description The issue is related to...

CVE-2014-9466: Undefined Security Weakness

Open-Xchange OX AppSuite and Server before 7.4.2-rev42, 7.6.0 before 7.6.0-rev36, and 7.6.1 before 7.6.1-rev14 does not properly handle directory permissions, which allows remote authenticated users to read files via unspecified vectors, related to the "folder identifier."...