44 matches found
CVE-2026-119427
phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting that allows authenticated users to inject SQL via unescaped jsonencode output. Attackers can send crafted index or value parameters with operation=savesettingvalue to /database/designer to overwrite other...
SUSE CVE-2026-119427
phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting that allows authenticated users to inject SQL via unescaped jsonencode output. Attackers can send crafted index or value parameters with operation=savesettingvalue to /database/designer to overwrite other...
pfsense-logs-filter-xss
abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-logs-filter-xss pfsense-logs-filter-xss Class: XSS Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org statuslogsfilter.php POST resolve= jsonencode with no JSONHEXTAG and default Content-Type...
phpmyadmin-webauthn
abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · phpmyadmin-webauthn Write-up: https://abraxaslabs.tech/research/phpmyadmin-webauthn phpmyadmin-webauthn Class: 2FA bypass Reach: Remote phpMyAdmin 5.2.3 tag RELEASE523. Default tarball. web-auth/webauthn-lib is sugges...
DEBIAN-CVE-2026-119427
phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting that allows authenticated users to inject SQL via unescaped jsonencode output. Attackers can send crafted index or value parameters with operation=savesettingvalue to /database/designer to overwrite other...
CVE-2026-119427
phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting that allows authenticated users to inject SQL via unescaped jsonencode output. Attackers can send crafted index or value parameters with operation=savesettingvalue to /database/designer to overwrite other...
CVE-2026-119427
phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting that allows authenticated users to inject SQL via unescaped jsonencode output. Attackers can send crafted index or value parameters with operation=savesettingvalue to /database/designer to overwrite other...
EUVD-2026-113807
phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting that allows authenticated users to inject SQL via unescaped jsonencode output. Attackers can send crafted index or value parameters with operation=savesettingvalue to /database/designer to overwrite other...
CVE-2026-119427
phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting that allows authenticated users to inject SQL via unescaped jsonencode output. Attackers can send crafted index or value parameters with operation=savesettingvalue to /database/designer to overwrite other...
CVE-2026-119427 phpMyAdmin through 5.2.3 SQL Injection via Designer saveSetting
phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting that allows authenticated users to inject SQL via unescaped jsonencode output. Attackers can send crafted index or value parameters with operation=savesettingvalue to /database/designer to overwrite other...
CVE-2026-119427
Versions of phpMyAdmin through 5.2.3 are vulnerable to an SQL injection in the Designer component's saveSetting() function. The root cause is the use of unescaped json_encode() output, which allows authenticated users to inject SQL by sending crafted index or value parameters with operation=save_...
CVE-2026-119427
phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting that allows authenticated users to inject SQL via unescaped jsonencode output. Attackers can send crafted index or value parameters with operation=savesettingvalue to /database/designer to overwrite other...
CVE-2026-119427 phpMyAdmin through 5.2.3 SQL Injection via Designer saveSetting
phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting that allows authenticated users to inject SQL via unescaped jsonencode output. Attackers can send crafted index or value parameters with operation=savesettingvalue to /database/designer to overwrite other...
CVE-2026-119427: phpMyAdmin: phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated…
phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting that allows authenticated users to inject SQL via unescaped jsonencode output. Attackers can send crafted index or value parameters with operation=savesettingvalue to /database/designer to overwrite other...
pfsense-logs-filter-xss
abraxaslabs.tech · github.com/abraxas ·&...
CVE-2026-97643 GiveWP <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via givewp_campaign_grid Shortcode Attributes
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's givewpcampaigngrid shortcode in versions up to, and including, 4.17.0 This is due to insufficient input sanitization and output escaping on user supplied...
CVE-2026-95665
MISP contains a reflected cross-site scripting XSS vulnerability in the event REST search export confirmation form. The view template app/View/Events/ajax/eventRestSearchExportConfirmationForm.ctp renders a URL-supplied event ID list into a single-quoted JavaScript string literal using PHP's...
CVE-2026-95665 MISP Reflected Cross-Site Scripting in Event Export Confirmation Form via Unescaped JSON
MISP contains a reflected cross-site scripting XSS vulnerability in the event REST search export confirmation form. The view template app/View/Events/ajax/eventRestSearchExportConfirmationForm.ctp renders a URL-supplied event ID list into a single-quoted JavaScript string literal using PHP's...
CVE-2026-95665 MISP Reflected Cross-Site Scripting in Event Export Confirmation Form via Unescaped JSON
MISP contains a reflected cross-site scripting XSS vulnerability in the event REST search export confirmation form. The view template app/View/Events/ajax/eventRestSearchExportConfirmationForm.ctp renders a URL-supplied event ID list into a single-quoted JavaScript string literal using PHP's...
EUVD-2026-84377
MISP contains a reflected cross-site scripting XSS vulnerability in the event REST search export confirmation form. The view template app/View/Events/ajax/eventRestSearchExportConfirmationForm.ctp renders a URL-supplied event ID list into a single-quoted JavaScript string literal using PHP's...