1770 matches found
CVE-2023-54400 Fumeng Cloud SQL Injection via AjaxMethod.ashx getEmpByname
Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary SQL through the Name parameter of the getEmpByname action without any authentication. Attackers can exploit UNION-based SQL injection...
CVE-2023-54400 Fumeng Cloud SQL Injection via AjaxMethod.ashx getEmpByname
Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary SQL through the Name parameter of the getEmpByname action without any authentication. Attackers can exploit UNION-based SQL injection...
CVE-2023-54400
Fumasoft Fumeng Cloud is vulnerable to a SQL injection flaw in the AjaxMethod.ashx endpoint. Specifically, the getEmpByname action fails to properly sanitize the Name parameter, allowing unauthenticated remote attackers to execute arbitrary SQL commands against the Microsoft SQL Server backend. E...
PT-2026-102632
Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary SQL through the Name parameter of the getEmpByname action without any authentication. Attackers can exploit UNION-based SQL injection...
CVE-2023-54400: Improper Neutralization of Special Elements used in an SQL Command
Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary SQL through the Name parameter of the getEmpByname action without any authentication. Attackers can exploit UNION-based SQL injection...
VulnCheck KEV: CVE-2023-54400
Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary SQL through the Name parameter of the getEmpByname action without any authentication. Attackers can exploit UNION-based SQL injection...
Microsoft SQL Server Management Studio Privilege Escalation
The vulnerability of the Microsoft SQL Server Management Studio SSMS management tool is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...
CVE-2026-92237
Insertion of sensitive information into log file in the slow query logging feature in Devolutions PowerShell Universal 2026.2.5 and earlier allows an authenticated user with log read permission to obtain application tokens, data protection key material and other stored credentials via SQL paramet...
CVE-2024-58385
Yonyou U8 CRM contains an unauthenticated SQL injection vulnerability in the fillbacksettingedit.php configuration endpoint where the DontCheckLogin=1 parameter bypasses authentication and the id parameter is incorporated into SQL queries without sanitization. Attackers can exploit this flaw to...
CVE-2024-58385 Yonyou U8 CRM SQL Injection via fillbacksettingedit.php
Yonyou U8 CRM contains an unauthenticated SQL injection vulnerability in the fillbacksettingedit.php configuration endpoint where the DontCheckLogin=1 parameter bypasses authentication and the id parameter is incorporated into SQL queries without sanitization. Attackers can exploit this flaw to...
CVE-2024-58385: Improper Neutralization of Special Elements used in an SQL Command
Yonyou U8 CRM contains an unauthenticated SQL injection vulnerability in the fillbacksettingedit.php configuration endpoint where the DontCheckLogin=1 parameter bypasses authentication and the id parameter is incorporated into SQL queries without sanitization. Attackers can exploit this flaw to...
CVE-2026-92237: Insertion of Sensitive Information into Log File
Insertion of sensitive information into log file in the slow query logging feature in Devolutions PowerShell Universal 2026.2.5 and earlier allows an authenticated user with log read permission to obtain application tokens, data protection key material and other stored credentials via SQL paramet...
PT-2026-93168
Name of the Vulnerable Software and Affected Versions Devolutions PowerShell Universal versions prior to 2026.2.6 Description The slow query logging feature allows the insertion of sensitive information into log files. An authenticated user with log read permissions can obtain application tokens,...
Microsoft SQL Server (September 2026)
The Microsoft SQL Server installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network. CVE-2026-77482 - Integer overflow or wraparound ...
Microsoft SQL Server Remote Code Execution Vulnerability
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network...
Microsoft SQL Server Remote Code Execution Vulnerability
Use after free in SQL Server allows an authorized attacker to execute code over a network...
Microsoft SQL Server Remote Code Execution Vulnerability
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network...
Microsoft SQL Server Security Feature Bypass Vulnerability
Insufficient logging in SQL Server allows an authorized attacker to bypass a security feature over a network...