6 matches found
CVE-2026-89267
starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchablefields allowlist when configured as an empty list, allowing authenticated users to filter on non-searchable fields. Attackers can submit structured filter queries via the list API's where parameter to perform equality an...
CVE-2026-89267
starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchable_fields allowlist when it is configured as an empty list. As a result, authenticated users can submit structured filter queries via the list API's where parameter to perform equality and comparison operations on columns ...
CVE-2026-89267 starlette-admin 0.16.1 through 0.17.1 Searchable Fields Allowlist Bypass
starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchablefields allowlist when configured as an empty list, allowing authenticated users to filter on non-searchable fields. Attackers can submit structured filter queries via the list API's where parameter to perform equality an...
CVE-2026-89267 starlette-admin 0.16.1 through 0.17.1 Searchable Fields Allowlist Bypass
starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchablefields allowlist when configured as an empty list, allowing authenticated users to filter on non-searchable fields. Attackers can submit structured filter queries via the list API's where parameter to perform equality an...
CVE-2026-89267 starlette-admin 0.16.1 through 0.17.1 Searchable Fields Allowlist Bypass
starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchablefields allowlist when configured as an empty list, allowing authenticated users to filter on non-searchable fields. Attackers can submit structured filter queries via the list API's where parameter to perform equality an...
EUVD-2026-45214
Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, Symfony\UX\Autocomplete\Doctrine\EntitySearchUtil::addSearchClause builds the LIKE expression used by the autocomplete endpoint by wrapping the client-supplied query in %...% without escaping SQL LIKE wildcards %...