GraphCrawler

GraphCrawler THE GraphQL automated testing tookit Graph Crawler is the most powerful automated testing toolkit for any GraphQL endpoint. Version 1.2 is out!! NEW: Can search for endpoints for you using Escape Technology's powerful Graphinder tool. Just point it towards a domain and add the '-e'...

CVE-2026-61651

SuiteCRM is vulnerable to an authenticated SQL injection in the get_end_date action within the Projects Controller in versions prior to 7.15.2 and 8.10.2 . The root cause is the lack of parameterization when the application concatenates an authenticated caller's task_id value into a SQL query. A ...

CVE-2026-63489

Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. In version 2.5.0 and earlier, YETI directly interpolates user-controlled sorting fields and filteraliases attribute paths into ArangoDB AQL identifier and expression positions in...

Number Sea Wen Zhou Visual Drag-and-Drop Big Data Integration Platform Backend Authorization Vulnerability

The Noshai Wenzhou Visual Drag-and-Drop Big Data Integration Platform has an authorization issue in its backend. This vulnerability stems from insecure direct object references. Members of the workspace who are authenticated can access data sources in other workspaces by sending an external...

CVE-2026-73670

A CMS contains a SQL injection vulnerability in admin/dbdata.php at line 509 that allows authenticated administrators to inject arbitrary SQL into a SHOW COLUMNS FROM statement by supplying unsanitized input through the tablename GET or POST parameter. Attackers can perform table traversal,...

CVE-2026-73670 CMS Admin SQL Injection via db_data.php table_name Parameter

A CMS contains a SQL injection vulnerability in admin/dbdata.php at line 509 that allows authenticated administrators to inject arbitrary SQL into a SHOW COLUMNS FROM statement by supplying unsanitized input through the tablename GET or POST parameter. Attackers can perform table traversal,...

CVE-2026-73670 CMS Admin SQL Injection via db_data.php table_name Parameter

A CMS contains a SQL injection vulnerability in admin/dbdata.php at line 509 that allows authenticated administrators to inject arbitrary SQL into a SHOW COLUMNS FROM statement by supplying unsanitized input through the tablename GET or POST parameter. Attackers can perform table traversal,...

EUVD-2026-58106

A CMS contains a SQL injection vulnerability in admin/dbdata.php at line 509 that allows authenticated administrators to inject arbitrary SQL into a SHOW COLUMNS FROM statement by supplying unsanitized input through the tablename GET or POST parameter. Attackers can perform table traversal,...

PT-2026-71691

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A CMS contains a SQL injection flaw in the 'admin/db data.php' endpoint. Authenticated administrators can inject arbitrary SQL into a SHOW COLUMNS FROM statement...

CVE-2026-72800

SiYuan versions before v3.7.4 fail to apply publish-access filtering to the getAttributeViewKeysByID endpoint, allowing authenticated readers to retrieve complete database column schemas including descriptions, select vocabularies, and template expressions. Additionally, getBlockDefIDsByRefText a...

CVE-2025-50455

SQL injection vulnerability exists in the orderby parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments = 1.5.1. The vulnerability arises from unsanitized user input passed to the orderby method of the CodeIgniter Query Builder, enabling attackers to perform time-based...

CVE-2025-50455

SQL injection vulnerability exists in the orderby parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments = 1.5.1. The vulnerability arises from unsanitized user input passed to the orderby method of the CodeIgniter Query Builder, enabling attackers to perform time-based...

CVE-2025-50455: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability exists in the orderby parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments = 1.5.1. The vulnerability arises from unsanitized user input passed to the orderby method of the CodeIgniter Query Builder, enabling attackers to perform time-based...

PT-2026-64973

Name of the Vulnerable Software and Affected Versions Alex Tselegidis EasyAppointments versions prior to 1.5.2 Description An SQL injection issue exists in the '/customers/search' endpoint via the order by parameter. The flaw occurs because unsanitized user input is passed to the order by functio...

GraphQL Introspection Abuse

Confirm GraphQL introspection, enumerate schema types/fields, and flag sensitive queries users, admin, secrets for follow-up exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """ GraphQL introspection and lightweight abuse probe. Runs full introspection when enabled, surfaces sensitive...

CVE-2026-44206

Frappe is a full-stack web application framework. Prior to versions 15.107.2 and 16.17.4, DB Schema Enumeration is possible through exploiting an endpoint. This issue has been patched in versions 15.107.2 and 16.17.4...

CVE-2026-44206

Frappe (full-stack web application framework) contains CVE-2026-44206, where DB Schema Enumeration is possible via a vulnerable endpoint prior to versions 15.107.2 and 16.17.4. The issue has been patched in those versions. The CVSS 4.0 base score is 6.9 (MEDIUM) with network attack vector, low co...

EUVD-2026-36490

Frappe is a full-stack web application framework. Prior to versions 15.107.2 and 16.17.4, DB Schema Enumeration is possible through exploiting an endpoint. This issue has been patched in versions 15.107.2 and 16.17.4...

CVE-2026-44206

Frappe is a full-stack web application framework. Prior to versions 15.107.2 and 16.17.4, DB Schema Enumeration is possible through exploiting an endpoint. This issue has been patched in versions 15.107.2 and 16.17.4...

CVE-2026-44206 Frappe: DB Schema Enumeration via Frappe-Authorization-Source

Frappe is a full-stack web application framework. Prior to versions 15.107.2 and 16.17.4, DB Schema Enumeration is possible through exploiting an endpoint. This issue has been patched in versions 15.107.2 and 16.17.4...