8368 matches found
CVE-2025-10692
The endpoint POST /api/staff/get-new-tickets concatenates the user-controlled parameter departmentId directly into the SQL WHERE clause without parameter binding. As a result, an authenticated staff user level ≥ 1 can inject SQL to alter the filter logic, effectively bypassing department scoping...
EUVD-2025-32372
The endpoint POST /api/staff/get-new-tickets concatenates the user-controlled parameter departmentId directly into the SQL WHERE clause without parameter binding. As a result, an authenticated staff user level ≥ 1 can inject SQL to alter the filter logic, effectively bypassing department scoping...
CVE-2025-10692 OpenSupports 4.11.0 — SQL Injection
The endpoint POST /api/staff/get-new-tickets concatenates the user-controlled parameter departmentId directly into the SQL WHERE clause without parameter binding. As a result, an authenticated staff user level ≥ 1 can inject SQL to alter the filter logic, effectively bypassing department scoping...
EUVD-2022-47877
Malicious code in bioql PyPI...
EUVD-2025-26471
Malicious code in bioql PyPI...
EUVD-2023-31217
Malicious code in bioql PyPI...
EUVD-2025-1950
Malicious code in bioql PyPI...
EUVD-2023-50445
Malicious code in bioql PyPI...
EUVD-2025-21930
Malicious code in bioql PyPI...
EUVD-2022-3847
Malicious code in bioql PyPI...
EUVD-2025-25813
Malicious code in bioql PyPI...
EUVD-2025-21919
Malicious code in bioql PyPI...
EUVD-2022-38873
Malicious code in bioql PyPI...
EUVD-2022-4577
Malicious code in bioql PyPI...
EUVD-2023-23397
Malicious code in bioql PyPI...
EUVD-2024-52446
Malicious code in bioql PyPI...
EUVD-2023-0765
Malicious code in bioql PyPI...
EUVD-2023-55635
Malicious code in bioql PyPI...