CVE-2026-73670 CMS Admin SQL Injection via db_data.php table_name Parameter

A CMS contains a SQL injection vulnerability in admin/dbdata.php at line 509 that allows authenticated administrators to inject arbitrary SQL into a SHOW COLUMNS FROM statement by supplying unsanitized input through the tablename GET or POST parameter. Attackers can perform table traversal,...

CVE-2026-73670 CMS Admin SQL Injection via db_data.php table_name Parameter

A CMS contains a SQL injection vulnerability in admin/dbdata.php at line 509 that allows authenticated administrators to inject arbitrary SQL into a SHOW COLUMNS FROM statement by supplying unsanitized input through the tablename GET or POST parameter. Attackers can perform table traversal,...

EUVD-2026-58106

A CMS contains a SQL injection vulnerability in admin/dbdata.php at line 509 that allows authenticated administrators to inject arbitrary SQL into a SHOW COLUMNS FROM statement by supplying unsanitized input through the tablename GET or POST parameter. Attackers can perform table traversal,...

CVE-2026-73670: Improper Neutralization of Special Elements used in an SQL Command

A CMS contains a SQL injection vulnerability in admin/dbdata.php at line 509 that allows authenticated administrators to inject arbitrary SQL into a SHOW COLUMNS FROM statement by supplying unsanitized input through the tablename GET or POST parameter. Attackers can perform table traversal,...

PT-2026-71691

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A CMS contains a SQL injection flaw in the 'admin/db data.php' endpoint. Authenticated administrators can inject arbitrary SQL into a SHOW COLUMNS FROM statement...

CVE-2026-73408: Improper Neutralization of Special Elements used in an SQL Command

Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mysql.ts enabled multipleStatements and inserted an unescaped tableName into a DESCRIBE statement. An attacker able to create a MySQL table with a backtick and stacked statement in its name could wait...

CVE-2026-73502

creationtimestamp| type| source ---|---|--- 2026-08-12 22:35:02+00:00| published-proof-of-concept| https://github.com/getkin/kin-openapi/security/advisories/GHSA-jpcw-4wr7-c3vq...

Duplicate Advisory: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeration oracles (publish mode)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5fhr-f75j-8wr9. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 fail to apply publish-access filtering to the getAttributeViewKeysByID endpoint, allowi...

CVE-2026-19503

MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an OIDC issuer's discovery document. A user induced to connect to an uncontrolled MongoDB deployment using MONGODB-OIDC authentication may have an uncontrolled...

CVE-2026-19502

MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnosti...

UBUNTU-CVE-2026-19502

MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnosti...

UBUNTU-CVE-2026-19503

MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an OIDC issuer's discovery document. A user induced to connect to an uncontrolled MongoDB deployment using MONGODB-OIDC authentication may have an uncontrolled...

CVE-2026-19503 Insufficient OIDC endpoint validation could invoke unintended local protocol handlers

MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an OIDC issuer's discovery document. A user induced to connect to an uncontrolled MongoDB deployment using MONGODB-OIDC authentication may have an uncontrolled...

EUVD-2026-57551

MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an OIDC issuer's discovery document. A user induced to connect to an uncontrolled MongoDB deployment using MONGODB-OIDC authentication may have an uncontrolled...

CVE-2026-72800

SiYuan versions before v3.7.4 fail to apply publish-access filtering to the getAttributeViewKeysByID endpoint, allowing authenticated readers to retrieve complete database column schemas including descriptions, select vocabularies, and template expressions. Additionally, getBlockDefIDsByRefText a...

CVE-2026-19502

MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnosti...

EUVD-2026-57549

MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnosti...

CVE-2026-19502

CVE-2026-19502 affects MongoDB SQL Schema Builder CLI. The issue is insufficient redaction of sensitive startup/connection configuration in diagnostic output (stdout and log files), allowing a local user with access to terminals or logs to view authentication material. The documentation provided ...

CVE-2026-19502 Insufficient redaction of sensitive configuration values in diagnostic output of MongoDB SQL Schema Builder CLI

MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnosti...

CVE-2026-19502 Insufficient redaction of sensitive configuration values in diagnostic output of MongoDB SQL Schema Builder CLI

MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnosti...