CVE-2025-48912

An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data. This issue affects...

CVE-2025-48912 Apache Superset: Improper authorization bypass on row level security via SQL Injection

An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data. This issue affects...

CVE-2025-48912 Apache Superset: Improper authorization bypass on row level security via SQL Injection

An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data. This issue affects...

CVE-2025-48912 Apache Superset: Improper authorization bypass on row level security via SQL Injection

An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data. This issue affects...

CVE-2025-48757

An insufficient database Row-Level Security policy in Lovable through 2025-04-15 allows remote unauthenticated attackers to read or write to arbitrary database tables of generated sites. NOTE: this is disputed by the Supplier because each individual customer of the Lovable platform accepts a...

PT-2025-24602 · Crates.Io · Arrow2

Rows::row unchecked allows out of bounds access to the underlying buffer without sufficient checks. The arrow2 crate is no longer maintained, so there are no plans to fix this issue. Users are advised to migrate to the arrow crate, instead...

PT-2025-23236

Name of the Vulnerable Software and Affected Versions Lovable versions prior to 2025-04-15 Description An insufficient database Row-Level Security RLS policy allows remote unauthenticated attackers to read or write to arbitrary database tables of generated sites. Row-Level Security is a database...

CVE-2025-48757

An insufficient database Row-Level Security policy in Lovable through 2025-04-15 allows remote unauthenticated attackers to read or write to arbitrary database tables of generated sites. NOTE: this is disputed by the Supplier because each individual customer of the Lovable platform accepts a...

Apache Superset SQL注入漏洞

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. An SQL injection vulnerability exists in Apache Superset versions prior to 4.1.2 that originates from an authenticated malicious actor that can bypass row-level security configurations via a...

PT-2025-23275

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 4.1.2 Description An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into sqlExpression fields. This allowed the execution of...

Lovable 安全漏洞

Lovable is an AI full-stack application builder from Lovable. A security vulnerability exists in Lovable versions 2025-04-15 and earlier, which stems from an insufficient database row-level security policy that could allow an unauthenticated attacker to read and write arbitrary database tables...

CVE-2024-10421

A vulnerability classified as critical was found in SourceCodester Attendance and Payroll System 1.0. This vulnerability affects unknown code of the file /admin/overtimerow.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been...

CVE-2023-22847

Information disclosure vulnerability exists in pgivm versions prior to 1.5.1. An Incrementally Maintainable Materialized View IMMV created by pgivm may reflect rows with Row-Level Security that the owner of the IMMV should not have access to. As a result, information in tables protected by...

CVE-2023-2053

A vulnerability, which was classified as critical, has been found in Campcodes Advanced Online Voting System 1.0. Affected by this issue is some unknown functionality of the file /admin/candidatesrow.php. The manipulation of the argument id leads to sql injection. The attack may be launched...

CVE-2023-2048

A vulnerability was found in Campcodes Advanced Online Voting System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/votersrow.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has...

CVE-2023-1849

A vulnerability was found in SourceCodester Online Payroll System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/cashadvancerow.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotel...

CVE-2023-1845

A vulnerability, which was classified as critical, was found in SourceCodester Online Payroll System 1.0. This affects an unknown part of the file /admin/employeerow.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has be...

CVE-2023-1846

A vulnerability has been found in SourceCodester Online Payroll System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/deductionrow.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has bee...

CVE-2023-1848

A vulnerability was found in SourceCodester Online Payroll System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/attendancerow.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit ha...

CVE-2022-44947

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting XSS vulnerability in the Highlight Row feature at /index.php?module=entities/listingtypesid=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Note fiel...