CVE-2026-86460 Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence

Cypher injection vulnerability in the Neo4j persistence layer when processing some FIQL search conditions. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fi...

CVE-2026-78416

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interprete...

CVE-2026-72778: Improperly Controlled Modification of Dynamically-Determined Object Attributes

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in the control panel element-search condition handling. Craft cleanses the outer request-controlled condition array via Component::cleanseConfig, but...

PT-2025-2120

Name of the Vulnerable Software and Affected Versions Car Demon plugin for WordPress versions up to, and including, 1.8.1 Description The Car Demon plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search condition parameter due to insufficient input sanitization and...

RuvarOA security vulnerabilities

RuvarOA is an office automation system of Ruvar China. A SQL injection vulnerability exists in RuvarOA v6.01 and v12.01, which is caused by the lack of validation of the PageID parameter in the /WebUtility/SearchCondiction.aspx file against external SQL input. An attacker can exploit this...

Yii Search Conditional Injection Vulnerability

Yii is the Yii team developed a set of component-based , high-performance PHP framework for developing large-scale Web applications . A security vulnerability exists in version 2.x of Yii prior to 2.0.15. A remote attacker can exploit the vulnerability to inject malicious search conditions...

CVE-2018-8074

Yii 2.x before 2.0.15 allows remote attackers to inject unintended search conditions via a variant of the CVE-2018-7269 attack in conjunction with the Elasticsearch extension...

PT-2018-18420

Name of the Vulnerable Software and Affected Versions: Yii versions prior to 2.0.15 Description: The issue allows remote attackers to inject unintended search conditions via a variant of an attack in conjunction with the Elasticsearch extension. Recommendations: For versions prior to 2.0.15, upda...