113 matches found
org.apache.jackrabbit:jackrabbit-standalone-components (>=2.23.0-beta, <=2.23.5-beta), org.apache.jackrabbit:jackrabbit-webapp (>=2.23.0-beta, <=2.23.5-beta) potentially affected by CVE-2026-92414 via org.apache.jackrabbit:jackrabbit-jcr-server (>=2.23.0-beta, <=2.23.5-beta)
org.apache.jackrabbit:jackrabbit-jcr-server MAVEN version =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.5-beta Source cves: CVE-2026-92414 Source advisory: MEND:CVE-2026-92414...
org.apache.jackrabbit:jackrabbit-standalone-components (>=2.22.0, <=2.22.4), org.apache.jackrabbit:jackrabbit-webapp (>=2.22.0, <=2.22.4) +5 more potentially affected by CVE-2026-92414 via org.apache.jackrabbit:jackrabbit-jcr-server (>=2.22.0, <=2.22.4)
org.apache.jackrabbit:jackrabbit-jcr-server MAVEN version =2.22.0, =2.22.0, =2.22.0, =1.66.0, =3.0.0-beta2, =4.1.0 Source cves: CVE-2026-92414 Source advisory: MEND:CVE-2026-92414...
UBUNTU-CVE-2026-92692
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affected Sulu 2.6 and 3.0 release lines have a Smart Content QueryBuilder in src/Sulu/Component/Content/SmartContent/QueryBuilder.php that concatenates category identifiers from the...
CVE-2026-92692
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affected Sulu 2.6 and 3.0 release lines have a Smart Content QueryBuilder in src/Sulu/Component/Content/SmartContent/QueryBuilder.php that concatenates category identifiers from the...
GHSA-JG26-Q8HG-3PQ4 Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated)
Impact An unauthenticated JCR-SQL2 injection exists in the Smart Content category filter of the 2.x content query builder. Category IDs supplied through the public ?categories= query parameter are only trimmed and are then concatenated directly into a JCR-SQL2 WHERE clause, without the numeric...
Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated)
Impact An unauthenticated JCR-SQL2 injection exists in the Smart Content category filter of the 2.x content query builder. Category IDs supplied through the public ?categories= query parameter are only trimmed and are then concatenated directly into a JCR-SQL2 WHERE clause, without the numeric...
EUVD-2026-85532
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affected Sulu 2.6 and 3.0 release lines have a Smart Content QueryBuilder in src/Sulu/Component/Content/SmartContent/QueryBuilder.php that concatenates category identifiers from the...
CVE-2026-92692 Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated)
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affected Sulu 2.6 and 3.0 release lines have a Smart Content QueryBuilder in src/Sulu/Component/Content/SmartContent/QueryBuilder.php that concatenates category identifiers from the...
CVE-2026-92692
The Sulu PHP content management system (affected versions 2.6 and 3.0 prior to 2.6.25 and 3.0.8 ) is vulnerable to an unauthenticated JCR-SQL2 injection . The flaw exists in the Smart Content QueryBuilder at src/Sulu/Component/Content/SmartContent/QueryBuilder.php because category identifiers fro...
CVE-2026-92692 Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated)
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affected Sulu 2.6 and 3.0 release lines have a Smart Content QueryBuilder in src/Sulu/Component/Content/SmartContent/QueryBuilder.php that concatenates category identifiers from the...
CVE-2026-92692 Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated)
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affected Sulu 2.6 and 3.0 release lines have a Smart Content QueryBuilder in src/Sulu/Component/Content/SmartContent/QueryBuilder.php that concatenates category identifiers from the...
CVE-2026-92692: Improper Neutralization of Special Elements used in an SQL Command
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affected Sulu 2.6 and 3.0 release lines have a Smart Content QueryBuilder in src/Sulu/Component/Content/SmartContent/QueryBuilder.php that concatenates category identifiers from the...
PT-2026-97518
Name of the Vulnerable Software and Affected Versions Sulu versions prior to 2.6.25 Sulu versions prior to 3.0.8 Description Sulu is an open-source PHP content management system based on the Symfony framework. A JCR-SQL2 injection exists in the Smart Content QueryBuilder within...
Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons
Summary Multiple vulnerabilities in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons that are used by InfoSphere Information Server were addressed. Vulnerability Details CVEID:CVE-2025-58782 DESCRIPTION: Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache...
Adobe AEM JCR Compare Exposure Detection
Detected an exposed Adobe AEM JCR compare functionality that was accessible without proper authorization. This exposure may have allowed attackers to infer repository structure or sensitive content through comparison operations. !/usr/bin/env python3 -- coding: utf-8 -- """Detected an exposed Ado...
@adobe/helix-importer-jcr-packaging (>=2.0.2, <=2.0.16), @aidin36/xmp (>=0.1.0, <=0.2.2) +49 more potentially affected by CVE-2026-41673 via @xmldom/xmldom (>=0.9.0, <=0.9.9)
@xmldom/xmldom NPM version =0.9.0, =2.0.2, =0.1.0, =5.5.3, =1.0.22, =1.35.0, =1.5.1-beta.1723, =0.1.0, =2.1.2, =2.6.1, =2.98.0, =2.0.0, =2.2.0, =2.108.11 and more Source cves: CVE-2026-41673 Source advisory: GHSA-2V35-W6HQ-6MFW...
CVE-2023-25141
Apache Sling JCR Base 3.1.12 has a critical injection vulnerability when running on old JDK versions JDK 1.8.191 or earlier through utility functions in RepositoryAccessor. The functions getRepository and getRepositoryFromURL allow an application to access data stored in a remote location via JDN...
EUVD-2021-1005
Malware in sbrugna...