CVE-2026-62251 Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query

Homer is open source telecom observability software. Prior to version 11.0.283, the V4StatisticsQuery handler passes the user-supplied rawquery field directly to DuckDB without calling the sqlvalidator.ValidateRawSQL function used throughout the rest of the codebase. Any authenticated user can...

sparx_hack

Множественные уязвимости в Sparx Pro Cloud Server и Enterprise Architect Эксплойт для выполнения произвольной SQL-команды на сервере Sparx PCS без аутентификации. ПРИМЕЧАНИЕ: ключ НЕ верен , чтобы помешать s|rIpt kIddi3 легко взломать ;- Полное описание:...

cve-2025-25257

CVE-2025-25257 - Среда экспериментов Архитектура эксперимента среда моделирует уязвимые компоненты FortiWeb Уязвимая конечная точка: /api/system/fabric/config Вектор инъекции: HTTP-заголовок Authorization: Bearer Механизм: прямая конкатенация SQL f-строка Python Аутентификация: отсутствует полный...

CVE-2024-26026

CVE-2024-26026 BIG-IP Next Central Manager API неаутентифицированная SQL-инъекция ссылка: https://eclypsium.com/blog/big-vulnerabilities-in-next-gen-big-ip/...

CVE-2023-24203-and-CVE-2023-24204

CVE-2023-24203-and-CVE-2023-24204 Введение В постоянно развивающемся ландшафте кибербезопасности веб-приложения остаются главной целью для злоумышленников, стремящихся использовать уязвимости. Недавно в SourceCodester Simple Customer Relationship Management CRM System v1.0 были обнаружены две...

GO-2026-6621 SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking in github.com/siyuan-note/siyuan/kernel

SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword publish mode: cross-notebook read/write with statement stacking in github.com/siyuan-note/siyuan/kernel...

CVE-2024-8275

CVE-2024-8275 CVE-2024-8275 — это критическая уязвимость SQL-инъекции, обнаруженная в плагине WordPress The Events Calendar. Эта уязвимость затрагивает версии до 6.6.4 включительно. Проблема вызвана недостаточным экранированием параметра 'order' в функции tribehasnextevent. Поскольку ввод не...

CVE-2024-43917

CVE-2024-43917 Этот скрипт демонстрирует уязвимость SQL-инъекции, обнаруженную в плагине TI WooCommerce Wishlist для WordPress, версий до 2.8.2 CVE-2024-43917. Уязвимость позволяет неаутентифицированным пользователям выполнять произвольные SQL-команды в базе данных сайта, потенциально раскрывая...

CVE-2026-42708

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in AF themes WP Post Author wp-post-author allows Blind SQL Injection.This issue affects WP Post Author: from n/a through 4.0.0...

CVE-2026-42710

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in 10Web Slider by 10Web slider-wd allows Blind SQL Injection.This issue affects Slider by 10Web: from n/a through 1.2.63...

EUVD-2026-94303

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in AF themes WP Post Author wp-post-author allows Blind SQL Injection.This issue affects WP Post Author: from n/a through 4.0.0...

CVE-2026-42708 WordPress WP Post Author plugin <= 4.0.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in AF themes WP Post Author wp-post-author allows Blind SQL Injection.This issue affects WP Post Author: from n/a through 4.0.0...

CVE-2026-42708

The WP Post Author plugin by AF themes (versions through 4.0.0 ) is vulnerable to Blind SQL Injection due to the improper neutralization of special elements used in an SQL command (CWE-89 ). Exploitation of this flaw allows an attacker to execute unauthorized SQL queries. No specific remediation ...

CVE-2026-42708 WordPress WP Post Author plugin <= 4.0.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in AF themes WP Post Author wp-post-author allows Blind SQL Injection.This issue affects WP Post Author: from n/a through 4.0.0...

WordPress WP Post Author plugin <= 4.0.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Post Author versions = 4.0.0...

CVE-2026-42710 WordPress Slider by 10Web plugin <= 1.2.63 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in 10Web Slider by 10Web slider-wd allows Blind SQL Injection.This issue affects Slider by 10Web: from n/a through 1.2.63...

EUVD-2026-94302

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in 10Web Slider by 10Web slider-wd allows Blind SQL Injection.This issue affects Slider by 10Web: from n/a through 1.2.63...

CVE-2026-42710 WordPress Slider by 10Web plugin <= 1.2.63 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in 10Web Slider by 10Web slider-wd allows Blind SQL Injection.This issue affects Slider by 10Web: from n/a through 1.2.63...

CVE-2026-42710

The Slider by 10Web WordPress plugin (component: slider-wd ) is vulnerable to a Blind SQL Injection due to the improper neutralization of special elements used in an SQL command. This vulnerability affects versions from n/a through 1.2.63 . An attacker with high privileges could potentially explo...

WordPress Slider by 10Web plugin <= 1.2.63 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Slider by 10Web versions = 1.2.63...