CVE-2026-47199 Frappe: check_safe_sql_query Permits SELECT INTO OUTFILE

Frappe is a full-stack web application framework. Prior to 16.18.3 and 15.108.0, checksafesqlquery permitted SELECT INTO OUTFILE queries, which could potentially work on self-hosted sites if database permissions are not well aligned and MySQL FILE privileges are available. This issue is fixed in...

CVE-2025-56407

The CVE-2025-56407 entry affects HuangDou UTCMS V9, specifically the RunSql function in app/modules/ut-data/admin/mysql.php. The root cause is manipulation of the sql argument that enables SQL injection, with remote exploitation and publicly disclosed exploit capabilities. Public sources consiste...

UTCMS 安全漏洞

UTCMS is a content management system built on the UT framework by the individual developer of usaltool. A security vulnerability exists in UTCMS version V9, which originates from SQL injection due to incorrect manipulation of the parameter sql in the file app/modules/ut-data/admin/mysql.php...

MySQL File Uploader 1.0 - id SQL Injection

MySQL File Uploader 1.0 - id SQL Injection Exploit Title: MySQL Blob Uploader - File Upload to Database PHP Script v1.0 - SQL Injection Google Dork: N/A Date: 07.02.2017 Vendor Homepage: http://nelliwinne.net/ Software Buy:...

ezContents multiple vulnerabilities

ezContents multiple vulnerabilities PROGRAM: ezContents VENDOR: Marek Lyczba et al. [email protected] HOMEPAGE: http://www.visualshapers.com/ VULNERABLE VERSIONS: 1.40, 1.41, possibly others as well NOT VULNERABLE VERSIONS: none one hole fixed in 1.41 LOGIN REQUIRED: yes some issues, no some...