CVE-2026-75786 SQL Injection in Grafana Integration Endpoint (query.php)

Unsanitized concatenation of the module parameter in the Grafana datasource endpoint allows authenticated blind SQL injection. Affects Pandora FMS from 777 onwards...

CVE-2026-75786

The Pandora FMS software (version 777 onwards ) is vulnerable to an authenticated blind SQL injection due to the unsanitized concatenation of the module parameter in the Grafana datasource endpoint . This vulnerability allows an authenticated attacker to execute SQL commands against the backend d...

EUVD-2007-6285

Malware in sbrugna...

EUVD-2018-13275

Malware in sbrugna...

EUVD-2022-49247

Malicious code in bioql PyPI...

EUVD-2022-32566

Malicious code in bioql PyPI...

CVE-2025-59948: Improper Neutralization of Input During Web Page Generation

FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below do not sanitize certain event handler attributes in feed content, so by finding a page that renders feed entries without CSP, it is possible to execute an XSS payload. The Allow API access authentication setting needs to ...

CVE-2022-39996

Cross Site Scripting vulnerability in Teldats Router RS123, RS123w allows attacker to execute arbitrary code via the cmdcookie parameter to the upgrade/query.php page...

CVE-2022-39996: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in Teldats Router RS123, RS123w allows attacker to execute arbitrary code via the cmdcookie parameter to the upgrade/query.php page...

CVE-2022-39996

Cross Site Scripting vulnerability in Teldats Router RS123, RS123w allows attacker to execute arbitrary code via the cmdcookie parameter to the upgrade/query.php page...

CVE-2022-39996

The CVE-2022-39996 entry covers a Cross-Site Scripting vulnerability in Teldat RS123 and RS123w routers. Affected component: the upgrade/query.php page, exploitable via the cmdcookie parameter to cause arbitrary code execution. Official descriptions consistently identify XSS as the impact, with a...

CVE-2023-1395 SourceCodester Yoga Class Registration System list.php query cross site scripting

A vulnerability was found in SourceCodester Yoga Class Registration System 1.0. It has been declared as problematic. This vulnerability affects the function query of the file admin/user/list.php. The manipulation of the argument name leads to cross site scripting. The attack can be initiated...

SQL Injection

CakePHP is vulnerable to SQL Injection attacks. The vulnerability exists in limit and offset functions of Query.php due to unsantized user input which allows an attacker to inject and execute arbitrary SQL queries...

SQL Injection

liftkit/database is vulnerable to SQL Injection attacks. A specifically crafted attack statement through the processOrderBy function in Query.php allows a malicious user to inject and execute arbitrary SQL queries on the target system...

SQL Injection in liftkit/database

A vulnerability was found in liftkit database up to 2.13.1. It has been classified as critical. This affects the function processOrderBy of the file src/Query/Query.php. The manipulation leads to sql injection. Upgrading to version 2.13.2 is able to address this issue. The name of the patch is...

GHSA-8HCF-2M4V-F2RQ SQL Injection in liftkit/database

A vulnerability was found in liftkit database up to 2.13.1. It has been classified as critical. This affects the function processOrderBy of the file src/Query/Query.php. The manipulation leads to sql injection. Upgrading to version 2.13.2 is able to address this issue. The name of the patch is...

CVE-2016-15020

A vulnerability was found in liftkit database up to 2.13.1. It has been classified as critical. This affects the function processOrderBy of the file src/Query/Query.php. The manipulation leads to sql injection. Upgrading to version 2.13.2 is able to address this issue. The patch is named...

Sql injection

A vulnerability was found in liftkit database up to 2.13.1. It has been classified as critical. This affects the function processOrderBy of the file src/Query/Query.php. The manipulation leads to sql injection. Upgrading to version 2.13.2 is able to address this issue. The patch is named...

CVE-2016-15020 liftkit database Query.php processOrderBy sql injection

A vulnerability was found in liftkit database up to 2.13.1. It has been classified as critical. This affects the function processOrderBy of the file src/Query/Query.php. The manipulation leads to sql injection. Upgrading to version 2.13.2 is able to address this issue. The patch is named...

CVE-2016-15020: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in liftkit database up to 2.13.1. It has been classified as critical. This affects the function processOrderBy of the file src/Query/Query.php. The manipulation leads to sql injection. Upgrading to version 2.13.2 is able to address this issue. The patch is named...