CVE-2025-56380

CVE-2025-56380 — Frappe / ERPNext 中的基于时间的盲 SQL 注入（frappe.client.getvalue） 📌 摘要 在 Frappe Framework v15.72.4 的 frappe.client.getvalue API 端点中（以及 ERPNext v15.67.0 代码库中）发现了一个基于时间的盲 SQL 注入漏洞。具有 reporting/client API 访问权限的已认证用户可以通过 fieldname 参数注入 SQL。通过将时间延迟函数（例如 sleep15）插入 fieldname...

WordPress plugin Avada (Fusion) Builder 注入漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...

EUVD-2025-32134

Malicious code in bioql PyPI...

CVE-2025-56380

Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.getvalue API endpoint and a crafted script to the fieldname parameter...

CVE-2025-56380

CVE-2025-56380 affects Frappe Framework/ERPNext codebase (Frappe v15.72.4; ERPNext v15.67.0) via a SQL injection in the fieldname parameter of the frappe.client.get_value API endpoint. The vulnerability arises from unsafe concatenation of user input into SQL within the /api/method/frappe.client.g...

CVE-2025-56380

Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.getvalue API endpoint and a crafted script to the fieldname parameter...

CVE-2025-56380

Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.getvalue API endpoint and a crafted script to the fieldname parameter...

OSV-2018-159 Use-of-uninitialized-value in AAT::LookupFormat8<OT::IntType<unsigned short, 2u> >::get_value

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10953 Crash type: Use-of-uninitialized-value Crash state: AAT::LookupFormat8 ::getvalue AAT::Lookup ::getvalue AAT::StateTable::getclass...

Wireshark - memcpy (get_value / dissect_btatt) SIGSEGV

Exploit for multiple platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=653 The following SIGSEGV crash due to an invalid memory write can be observed in an ASAN build of Wireshark current git master, by feeding a malformed file to tshark "$...

Wireshark - memcpy get_value dissect_btatt SIGSEGV

Wireshark - memcpy getvalue dissectbtatt SIGSEGV Source: https://code.google.com/p/google-security-research/issues/detail?id=653 The following SIGSEGV crash due to an invalid memory write can be observed in an ASAN build of Wireshark current git master, by feeding a malformed file to tshark "$...