33363 matches found
CVE-2025-69945
kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /doctor/edit-patient.php?editid=1...
PT-2026-65931
Name of the Vulnerable Software and Affected Versions Adminer affected versions not specified Description Remote attackers with authentication can execute arbitrary code on the web server. The issue occurs within the multi query method due to an incorrect check of a function return value...
PT-2026-65925
Name of the Vulnerable Software and Affected Versions kishan0725 Hospital Management System version 4.0 Description The software contains a SQL Injection flaw in the 'check availability.php' endpoint. This issue occurs when the application improperly handles the emailid and email parameters,...
grafana: Grafana: Denial of Service due to excessive memory allocation via large JSON payloads
A flaw was found in Grafana. An unauthenticated attacker can exploit the public dashboard query endpoint by sending arbitrarily large JSON payloads. This vulnerability, caused by a lack of request body size limits, triggers excessive memory allocation, leading to a denial of service through memor...
CVE-2026-54658 @hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution
Hypequery is a TypeScript semantic layer for ClickHouse. Prior to 2.5.1, escapeValue in packages/clickhouse/src/core/utils.ts did not escape backslashes before single quotes during parameter substitution, allowing attacker controlled query parameters with a trailing backslash to escape the closin...
CVE-2026-54658 @hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution
Hypequery is a TypeScript semantic layer for ClickHouse. Prior to 2.5.1, escapeValue in packages/clickhouse/src/core/utils.ts did not escape backslashes before single quotes during parameter substitution, allowing attacker controlled query parameters with a trailing backslash to escape the closin...
CVE-2026-13442 Langflow is affected by NET Misconfiguration: Use of Impersonation due to multiple unauthenticated and insufficiently authorized API endpoints
IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to reuse another user's FAISS namespace to access owner-only vector content and influence later query results. This causes cross-user information disclosure and limited integrity impact through persistent poisoning of returned results...
CVE-2026-11391
Tanium addressed a SQL injection vulnerability in Patch...
EUVD-2026-50019
A SQL Injection in the Giving Reports functionality in Ellucian Advance Web and Legacy Advance allows an authenticated attacker to extract sensitive information from databases via a crafted SQL query in the class credit field. This issue affects Advance Web: all versions; Legacy Advance: all...
CVE-2026-50736
The pglogical queue mechanism, used to convey out-of-band commands such as replicated DDL from a publisher to a subscriber, executes message payloads on the subscriber at the privilege level of the apply worker, which is equivalent to a PostgreSQL superuser in default installations. A party actin...
CVE-2026-11391
CVE-2026-11391 involves a SQL injection vulnerability in Tanium’s Patch module. The connected documents confirm Tanium addressed the vulnerability, with a CVSS v3.1 base score of 6.3 (Network attack vector, Low privileges required, No user interaction; confidentiality, integrity, and availability...
CVE-2026-7769
CVE-2026-7769 affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (versions 6.2.0.0–6.2.0.5_2, 6.2.1.0–6.2.1.1_2, 6.2.2.0–6.2.2.0_1). Root cause: SQL injection in the backend database interface. Impact: remote attacker could view, add, modify, or delete data in the back-end DB. CVSS...
CVE-2026-51303
A flaw was found in SQLite. A remote attacker can exploit a use-after-free vulnerability in the core parsing component by sending specially crafted SQL queries. This can lead to an application crash, sensitive information disclosure, and potentially allow the attacker to execute arbitrary code on...
CVE-2026-51267
Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
PMB v7.4.6 - Cross-Site Scripting Detection
PMB v7.4.6 allows an attacker to perform a reflected XSS on exportz3950.php via the 'query' parameter. !/usr/bin/env python3 -- coding: utf-8 -- """PMB v7.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'PMB v7.4.6 -...
Jenzabar 9.2x-9.2.2 - Cross-Site Scripting Detection
Jenzabar 9.2.x through 9.2.2 contains a cross-site scripting vulnerability. It allows /ics?tool=search&query. !/usr/bin/env python3 -- coding: utf-8 -- """Jenzabar 9.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...
Academy LMS 6.0 - Cross-Site Scripting Detection
Creative Item Academy LMS 6.0 was discovered to contain a cross-site scripting XSS vulnerability through query parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Creative Item Academy LMS 6.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...
WooCommerce Blocks 2.5 to 5.5 - Unauthenticated SQL Injection Detection
woocommerce-gutenberg-products-block is a feature plugin for WooCommerce Gutenberg Blocks. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce Blocks feature plugin between version 2.5.0 and prior to version 2.5.16. Via a carefully crafted URL, an exploit can be...
WordPress Jannah Theme <5.4.5 - Cross-Site Scripting Detection
WordPress Jannah theme before 5.4.5 contains a reflected cross-site scripting vulnerability. It does not properly sanitize the 'query' POST parameter in its tieajaxsearch AJAX action. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Jannah theme before 5.""" from kittysploit import from...