CVE-2026-44666

HRConvert2 is a self-hosted, drag-and-drop & nosql file conversion server & share tool. Prior to 3.3.8, the sanitizeString function in convertCore.php is missing backtick and tab \t from its strip list. User input then reaches shellexec, where the shell interprets these characters and commands...

EUVD-2026-30480

HRConvert2 is a self-hosted, drag-and-drop & nosql file conversion server & share tool. Prior to 3.3.8, the sanitizeString function in convertCore.php is missing backtick and tab \t from its strip list. User input then reaches shellexec, where the shell interprets these characters and commands...

CVE-2026-33442

Kysely is a type-safe TypeScript SQL query builder. In versions 0.28.12 and 0.28.13, the sanitizeStringLiteral method in Kysely's query compiler escapes single quotes ' → '' but does not escape backslashes. On MySQL with the default BACKSLASHESCAPES SQL mode, an attacker can inject a backslash...

CVE-2026-33442

Kysely is a type-safe TypeScript SQL query builder. In versions 0.28.12 and 0.28.13, the sanitizeStringLiteral method in Kysely's query compiler escapes single quotes ' → '' but does not escape backslashes. On MySQL with the default BACKSLASHESCAPES SQL mode, an attacker can inject a backslash...

CVE-2026-33442 Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys.

Kysely is a type-safe TypeScript SQL query builder. In versions 0.28.12 and 0.28.13, the sanitizeStringLiteral method in Kysely's query compiler escapes single quotes ' → '' but does not escape backslashes. On MySQL with the default BACKSLASHESCAPES SQL mode, an attacker can inject a backslash...

SQL Injection

Overview kysely is a Type safe SQL query builder Affected versions of this package are vulnerable to SQL Injection via the sanitizeStringLiteral function. An attacker can execute arbitrary SQL commands by supplying specially crafted input containing backslashes and quotes, which are not properly...

SQL Injection

Overview kysely is a Type safe SQL query builder Affected versions of this package are vulnerable to SQL Injection via the sanitizeStringLiteral function. An attacker can execute arbitrary SQL commands by supplying specially crafted input containing backslashes and single quotes, which are not...

EUVD-2015-5546

Malware in sbrugna...

PT-2021-16126

Name of the Vulnerable Software and Affected Versions TranslatePress WordPress plugin versions prior to 2.0.9 Description The issue arises from the improper sanitization of translated strings. The trp sanitize string function only removes script tags using a regex, but still allows other HTML tag...

Cross site scripting

Incomplete blacklist in sanitizestring in Zenphoto before 1.4.9 allows remote attackers to conduct cross-site scripting XSS attacks...

PT-2019-7195

Name of the Vulnerable Software and Affected Versions Zenphoto versions prior to 1.4.9 Description The issue arises from the sanitize string function not properly sanitizing HTML tags, allowing remote attackers to perform a cross-site scripting XSS attack. This can be achieved by wrapping a paylo...

ZenPhoto cross-site scripting vulnerability (CNVD-2020-03822)

ZenPhoto is a free content management system for photo libraries. The system manages images and supports multimedia such as audio and video. A cross-site scripting vulnerability exists in the 'sanitizestring' function in versions of Zenphoto prior to 1.4.9, which stems from a lack of proper...

PT-2019-7194

Name of the Vulnerable Software and Affected Versions Zenphoto versions prior to 1.4.9 Description The issue is related to an incomplete blacklist in the sanitize string function, which allows remote attackers to conduct cross-site scripting XSS attacks. Recommendations For versions prior to 1.4....

ZenPhoto 'sanitize_string' function cross-site scripting vulnerability

Zenphoto is a free photo gallery content management system developed by the Zenphoto team. The system manages images and supports multimedia such as audio and video. A cross-site scripting vulnerability exists in the 'sanitizestring' function in versions of ZenPhoto prior to 1.4.9. A remote...

PT-2017-6868

Name of the Vulnerable Software and Affected Versions ZenPhoto versions prior to 1.4.9 Description The issue is related to the sanitize string function, which used the html entity decode function after input sanitation. This could potentially allow remote attackers to perform a cross-site scripti...