7 matches found
CVE-2026-61852
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery implementation in server/modules/ai/orchestrator/tools/runQuery.js interpolates the AI tool's rowlimit parameter into a SQL LIMIT...
CVE-2026-61852
Chartbrew (open-source charting web app) prior to 5.2.2 is vulnerable to SQL injection in its AI runQuery() tool (server/modules/ai/orchestrator/tools/runQuery.js). The row_limit parameter is interpolated into a SQL LIMIT clause without integer validation; because the read-only keyword check exec...
CVE-2026-61852 Chartbrew: SQL Injection via row_limit Parameter in AI runQuery Tool
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery implementation in server/modules/ai/orchestrator/tools/runQuery.js interpolates the AI tool's rowlimit parameter into a SQL LIMIT...
CVE-2026-61852 Chartbrew: SQL Injection via row_limit Parameter in AI runQuery Tool
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery implementation in server/modules/ai/orchestrator/tools/runQuery.js interpolates the AI tool's rowlimit parameter into a SQL LIMIT...
CVE-2026-61852: Improper Neutralization of Special Elements used in an SQL Command
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery implementation in server/modules/ai/orchestrator/tools/runQuery.js interpolates the AI tool's rowlimit parameter into a SQL LIMIT...
CVE-2009-5024
ViewVC before 1.1.11 allows remote attackers to bypass the cvsdb rowlimit configuration setting, and consequently conduct resource-consumption attacks, via the limit parameter, as demonstrated by a "query revision history" request...
Cross site request forgery (csrf)
ViewVC before 1.1.11 allows remote attackers to bypass the cvsdb rowlimit configuration setting, and consequently conduct resource-consumption attacks, via the limit parameter, as demonstrated by a "query revision history" request...