32405 matches found
WS-2020-0025
All versions of mongodb-query-parser are vulnerable to Remote Code Execution. The package fails to sanitize queries, allowing attackers to execute arbitrary code in the system...
CVE-2026-6225
The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'projectsearch' parameter in all versions up to, and including, 5.0.6 due to insufficient escaping on the user supplied parameter and lack of...
CVE-2026-6225
The CVE concerns the WordPress plugin Taskbuilder – Project Management & Task Management Tool With Kanban Board . It is vulnerable to a time-based blind SQL Injection via the 'project_search' parameter in all versions up to and including 5.0.6 , caused by insufficient escaping and inadequate prep...
WS-2019-0242
soletta-dev-app all versions are vulnerable to Command Injection when not validating user input on the /api/service/status API endpoint, passing contents of the service query parameter to an exec call...
WS-2019-0233
untitled-model all versions are vulnerable to SQL injection due to Query parameters that are not properly sanitized allowing attackers to inject SQL statements and execute arbitrary SQL queries...
WS-2019-0179
resquel all versions are vulnerable to SQL injection due to Query parameters that are not properly sanitized...
WS-2019-0053
Versions of sequelize prior to 4.12.0 are vulnerable to NoSQL Injection. Query operators such as $gt are not properly sanitized and may allow an attacker to alter data queries, leading to NoSQL Injection...
CVE-2026-46445
SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection...
WordPress WP Directory Kit plugin <= 1.5.1 - SQL Injection vulnerability
SQL Injection vulnerability discovered by daroo in WordPress Plugin WP Directory Kit versions = 1.5.1...
CVE-2026-46446
SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. This is related to cpassword = '%@' in changePasswordForLogin...
CVE-2026-46445
SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection...
WS-2016-0051
"Swagger UI is a dependency-free collection of HTML, JavaScript, and CSS assets.In versions 2.1.0-M1 and 2.1.0-M2, swagger-ui has a cross site scripting XSS vulnerability in the url query string parameter."...
EUVD-2026-30203
Insufficient sanitization of SQL queries in the sqloptimizer utility script allows SQL Injections on behalf of the root user if Slow Query logging is enabled...
PT-2026-40934
Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.43 n8n versions prior to 2.20.7 n8n versions prior to 2.22.1 Description An authenticated user with permissions to create or modify workflows can inject CLI flags during the Push operation of the Git node. This allo...
CVE-2026-6575: Buffer Over-read
Buffer over-read in PostgreSQL function pgrestoreattributestats accepts array values of unmatched length, which causes query planning to read past end of one array. This allows a table maintainer to infer memory values past that array end. Within major version 18, minor versions before PostgreSQL...
PT-2026-40927
Name of the Vulnerable Software and Affected Versions PostgreSQL versions 16.0 through 16.13 PostgreSQL versions 17.0 through 17.9 PostgreSQL versions 18.0 through 18.3 Description SQL injection in logical replication occurs when using the 'ALTER SUBSCRIPTION ... REFRESH PUBLICATION' command. Thi...
CVE-2025-62317: Use of GET Request Method With Sensitive Query Strings
HCL AION is affected by a vulnerability where sensitive information may be included in URL parameters. Passing sensitive data in URLs may expose it through browser history, logs, or intermediary systems, potentially leading to unintended information disclosure under certain conditions...
PT-2026-41150
Name of the Vulnerable Software and Affected Versions dbt-mcp versions prior to 1.17.1 Description The DefaultUsageTracker.emit tool called event function in src/dbt mcp/tracking/tracking.py serializes the complete arguments dictionary of every Model Context Protocol MCP tool call and transmits i...
The vulnerability of the ATMs system “BUK TS-G” lies in the lack of measures taken to protect SQL queries. This allows attackers to send arbitrary queries and gain access to protected information.
The vulnerability of the “BUK TS-G” automation system is related to the lack of measures taken to protect SQL queries. Exploiting this vulnerability allows a malicious actor to send arbitrary queries and gain access to protected information...