OS Command Injection

clawdbot is vulnerable to an OS command injection. The vulnerability is due to improper escaping and validation of user-supplied input in SSH-related functions, which allows an attacker to inject malicious command strings via the project root path or crafted SSH target arguments, leading to...

pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID

A flaw was found in pyasn1, a generic ASN.1 library for Python. A remote attacker could exploit this vulnerability by sending a specially crafted RELATIVE-OID with excessive continuation octets. This input validation vulnerability leads to memory exhaustion, resulting in a Denial of Service DoS f...

The vulnerability of the convert___skb_to_skb() function in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the convertskbtoskb function in the Linux operating system’s kernel is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability of the usbnet_probe() function in the drivers/net/usb/usbnet.c module of the Linux network adapter driver module allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the usbnetprobe function in the drivers/net/usb/usbnet.c module of the Linux network adapter driver module is related to insufficient input data validation. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility o...

HGiga C&Cm@il SQL注入漏洞

HGiga C&Cm@il is a mail collaboration system developed by China’s HGiga Corporation. HGiga C&Cm@il has a SQL injection vulnerability, which stems from insufficient input validation. This vulnerability could allow unverified remote attackers to inject arbitrary SQL commands to read data from the...

The vulnerability of the null_init_tag_set() function in the drivers/block/null_blk/main.c module of the Linux kernel’s block devices driver module allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the nullinittagset function in the drivers/block/nullblk/main.c module of the Linux kernel’s block devices driver is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

Adminer 输入验证错误漏洞

Adminer is an open-source WordPress plugin developed by Adminer. It allows WordPress administrators to perform database management tasks quickly. Versions of Adminer prior to 5.4.1 had a vulnerability related to input validation errors. This vulnerability stemmed from a lack of source verificatio...

Faraday affected by SSRF via protocol-relative URL host override in build_exclusive_url

Impact Faraday's buildexclusiveurl method in lib/faraday/connection.rb uses Ruby's URImerge to combine the connection's base URL with a user-supplied path. Per RFC 3986, protocol-relative URLs e.g. //evil.com/path are treated as network-path references that override the base URL's host/authority...

HGiga C&Cm@il SQL注入漏洞

HGiga C&Cm@il is an email collaboration system developed by China’s HGiga Corporation. HGiga C&Cm@il has a SQL injection vulnerability, which stems from insufficient input validation. This vulnerability could allow authenticated remote attackers to inject arbitrary SQL commands to retrieve databa...

The vulnerability of the gfs2_dinode_in() function in the fs/gfs2/dir.c file of the GFS2 file system in the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the gfs2dinodein function in the fs/gfs2/dir.c file of the GFS2 file system in the Linux operating system is related to insufficient input validation. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2026-7005

Name of the Vulnerable Software and Affected Versions code-projects Online Examination System version 1.0 Description A flaw exists in the Online Examination System that allows for SQL injection through the manipulation of the username and password arguments in the login.php file. This issue can ...

CVE-2026-1643

The MP-Ukagaka plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if...

The vulnerability of the smb2_get_name() function in the fs/smb/server/smb2pdu.c module of the SMB server kernel of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the smb2getname function in the fs/smb/server/smb2pdu.c module of the SMB server implementation in Linux operating systems is related to insufficient input validation. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2025-10258

Infinera DNA is vulnerable to a time-based SQL injection vulnerability due to insufficient input validation, which may result in leaking of sensitive information...

CVE-2025-15080

Improper Validation of Specified Quantity in Input vulnerability in Mitsubishi Electric MELSEC iQ-R Series R08PCPU, R16PCPU, R32PCPU, and R120PCPU allows an unauthenticated attacker to read device data or part of a control program from the affected product, write device data in the affected...

Improper Validation of Specified Type of Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input in the auth-proxy-set-headers annotation, which allows injection of configuration into nginx. An attacker can execute arbitrary code and access sensitive information by supplying crafted...

PT-2026-6822

Name of the Vulnerable Software and Affected Versions eLection version 2.0 Description The software contains an authenticated SQL injection issue in the candidate management endpoint. Attackers can manipulate database queries through the id parameter. Exploitation can be performed using SQLMap,...

n8n 输入验证错误漏洞

n8n is an open-source, scalable workflow automation tool developed by n8n. Prior to version 1.121.0, there was a vulnerability related to input validation errors in n8n. This vulnerability stemmed from improper validation of credentials in the HTTP Request node, allowing authenticated attackers t...

The vulnerability of the ingress controller in the Kubernetes cluster ingress-nginx, related to insufficient validation of incoming data, allows a perpetrator to gain unauthorized access to protected information and execute arbitrary code within the controller’s context.

The vulnerability of the ingress controller in the Kubernetes cluster ingress-nginx is related to insufficient validation of incoming data. Exploiting this vulnerability allows a malicious actor to gain unauthorized access to protected information and execute arbitrary code within the controller’...

Cisco Meeting Management (CMM) Code Issues Vulnerability

Cisco Meeting Management CMM is a management tool for Cisco Meeting Server, a Cisco local videoconferencing platform from Cisco USA. A code issue vulnerability exists in Cisco Meeting Management that stems from improper input validation in certain parts of the web-based management interface, whic...