1476 matches found
ketr JEPaaS SQL注入漏洞
ketr JEPaaS is a low-code rapid development platform open-sourced by China's ketr ketr. A SQL injection vulnerability exists in ketr JEPaaS 7.2.8 and earlier versions, which stems from incorrect manipulation of the parameter keyWord in the file /je/postil/postil/readAllPostil, which could lead to...
CVE-2025-11970: Server-Side Request Forgery (SSRF)
The Emplibot – AI Content Writer with Keyword Research, Infographics, and Linking | SEO Optimized | Fully Automated plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.9 via the emplibotcallwebhookwitherror and emplibotprocesszipdata...
PT-2025-51040
Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.1.4 Description A flaw exists in Apache Airflow where authenticated users of the user interface could view secret values within rendered templates. This occurred because secrets were not properly redacted,...
PT-2025-51039
Name of the Vulnerable Software and Affected Versions Airflow versions prior to 3.1.4 Airflow versions prior to 2.11.1 Description A flaw exists in Airflow where the user interface UI error reporting could expose sensitive information passed as keyword arguments kwargs to operators when a Directe...
Arbitrary Code Injection
Overview neuron-core/neuron-ai is a The PHP Agentic Framework. Affected versions of this package are vulnerable to Arbitrary Code Injection via the validation based on the first keyword e.g., SELECT and a forbidden-keyword list does not block file-writing constructs such in the MySQLSelectTool. A...
CVE-2024-58276
Obi08/Enrollment System 1.0 contains a SQL injection vulnerability in the keyword parameter of /getsubject.php that allows unauthenticated attackers to execute arbitrary SQL queries. Attackers can use UNION-based injection to extract sensitive information from the users table including usernames...
Enrollment System SQL注入漏洞
Enrollment System is an enrollment system software by Obi08 Individual Developer. A SQL injection vulnerability exists in Enrollment System version 1.0, which originates from SQL injection of the parameter keyword in /getsubject.php, which may result in the extraction of sensitive information...
CVE-2024-58276: Improper Neutralization of Special Elements used in an SQL Command
Obi08/Enrollment System 1.0 contains a SQL injection vulnerability in the keyword parameter of /getsubject.php that allows unauthenticated attackers to execute arbitrary SQL queries. Attackers can use UNION-based injection to extract sensitive information from the users table including usernames...
PT-2025-49132
Name of the Vulnerable Software and Affected Versions Obi08/Enrollment System version 1.0 Description The software contains a SQL injection issue in the keyword parameter of the '/get subject.php' API endpoint. Unauthenticated attackers can execute arbitrary SQL queries, potentially extracting...
SQL Injection
Overview Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Affected versions of this package are vulnerable to SQL Injection via the FilteredRelation column aliases. When a malicious dictionary expansion is passed in as the kwargs argument ...
Suricata 代码问题漏洞
Suricata is a network IDS, IPS and NSM engine from the Open Information Security Foundation. A code issue vulnerability exists in Suricata versions 8.0.0 through prior to 8.0.2, which stems from the entropy keyword when used with base64data may result in a null pointer dereference...
CVE-2025-64335: NULL Pointer Dereference
Suricata is a network IDS, IPS and NSM engine developed by the OISF Open Information Security Foundation and the Suricata community. In versions from 8.0.0 to before 8.0.2, a NULL dereference can occur when the entropy keyword is used in conjunction with base64data. This issue has been patched in...
ROS-20251125-12
Vulnerability of QuerySet and Q objects of Django web application development platform is related to failure to take measures to protect the SQL query structure when processing an argument with the connector keyword. Exploitation of the vulnerability could allow an attacker acting remotely to...
CVE-2025-13171
A vulnerability was identified in ZZCMS 2023. This impacts an unknown function of the file /admin/wangkanlist.php. Such manipulation of the argument keyword leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used...
MGASA-2025-0292 Updated python-django packages fix security vulnerability
Potential SQL injection via connector keyword argument in QuerySet and Q objects. CVE-2025-64459...
SUSE SLES15 / openSUSE 15 Security Update : python-Django (SUSE-SU-2025:4100-1)
The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4100-1 advisory. - CVE-2025-64459: Fixed a potential SQL injection via the 'connector' keyword bsc1252926 Tenable has extracted the preceding...
CVE-2025-13171
A vulnerability was identified in ZZCMS 2023. This impacts an unknown function of the file /admin/wangkanlist.php. Such manipulation of the argument keyword leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used...
CVE-2025-13171 ZZCMS wangkan_list.php sql injection
A vulnerability was identified in ZZCMS 2023. This impacts an unknown function of the file /admin/wangkanlist.php. Such manipulation of the argument keyword leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used...
Security update for python-Django
This update for python-Django fixes the following issues: CVE-2025-64459: Fixed a potential SQL injection via the 'connector' keyword bsc1252926 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively yo...