261859 matches found
CVE-2015-20122 Seeyon A6 OA Unauthenticated SQL Injection via downloadAtt.jsp
Seeyon A6 collaborative office automation platform contains an unauthenticated SQL injection vulnerability in the attachids parameter of the file attachment download endpoint that allows remote attackers to extract arbitrary database contents without prior authentication. Attackers can inject...
CVE-2015-20122
The Seeyon A6 collaborative office automation platform is vulnerable to an unauthenticated SQL injection within the attach_ids parameter of the file attachment download endpoint. By injecting UNION-based SQL statements through the attach_ids request parameter in downloadAtt.jsp, remote attackers ...
CVE-2015-20122 Seeyon A6 OA Unauthenticated SQL Injection via downloadAtt.jsp
Seeyon A6 collaborative office automation platform contains an unauthenticated SQL injection vulnerability in the attachids parameter of the file attachment download endpoint that allows remote attackers to extract arbitrary database contents without prior authentication. Attackers can inject...
EUVD-2015-9427
Seeyon A6 collaborative office automation platform contains an unauthenticated SQL injection vulnerability in the attachids parameter of the file attachment download endpoint that allows remote attackers to extract arbitrary database contents without prior authentication. Attackers can inject...
CVE-2026-102491 mahonelau kykms SqlInjectionUtil QueryGenerator.java QueryGenerator.doMultiFieldsOrder sql injection
A vulnerability was identified in mahonelau kykms up to 8f130c2d85842d5b44caae78cc46d65e505949f7. The impacted element is the function QueryGenerator.doMultiFieldsOrder of the file QueryGenerator.java of the component SqlInjectionUtil. The manipulation of the argument column leads to sql injectio...
CVE-2026-102491 mahonelau kykms SqlInjectionUtil QueryGenerator.java QueryGenerator.doMultiFieldsOrder sql injection
A vulnerability was identified in mahonelau kykms up to 8f130c2d85842d5b44caae78cc46d65e505949f7. The impacted element is the function QueryGenerator.doMultiFieldsOrder of the file QueryGenerator.java of the component SqlInjectionUtil. The manipulation of the argument column leads to sql injectio...
CVE-2026-102491
A SQL injection vulnerability exists in mahonelau kykms (up to commit 8f130c2d85842d5b44caae78cc46d65e505949f7) within the SqlInjectionUtil component. The flaw is located in the QueryGenerator.doMultiFieldsOrder function in the QueryGenerator.java file, where the manipulation of the column argume...
EUVD-2026-88974
A vulnerability was identified in mahonelau kykms up to 8f130c2d85842d5b44caae78cc46d65e505949f7. The impacted element is the function QueryGenerator.doMultiFieldsOrder of the file QueryGenerator.java of the component SqlInjectionUtil. The manipulation of the argument column leads to sql injectio...
CVE-2026-102570 ClipBucket v5 through 5.5.3-#197 SQL Injection via language_id Parameter
ClipBucket v5 through 5.5.3-197 contains a time-based blind SQL injection vulnerability in the language update function where the languageid parameter is concatenated unescaped into the WHERE clause of an UPDATE statement. An authenticated administrator with basicsettings permission can inject...
CVE-2026-102569 ClipBucket v5 through 5.5.3-#197 SQL Injection via videoid Parameter
ClipBucket v5 through 5.5.3-197 contains a time-based blind SQL injection vulnerability in the admin video edit function where the videoid parameter is concatenated into an UPDATE statement without proper escaping. An authenticated administrator with videomoderation permission can inject arbitrar...
CVE-2026-102569 ClipBucket v5 through 5.5.3-#197 SQL Injection via videoid Parameter
ClipBucket v5 through 5.5.3-197 contains a time-based blind SQL injection vulnerability in the admin video edit function where the videoid parameter is concatenated into an UPDATE statement without proper escaping. An authenticated administrator with videomoderation permission can inject arbitrar...
EUVD-2026-88970
ClipBucket v5 through 5.5.3-197 contains a time-based blind SQL injection vulnerability in the admin video edit function where the videoid parameter is concatenated into an UPDATE statement without proper escaping. An authenticated administrator with videomoderation permission can inject arbitrar...
CVE-2026-102570
ClipBucket versions v5 through 5.5.3-#197 are vulnerable to a time-based blind SQL injection within the language update function. The flaw exists because the language_id parameter is concatenated unescaped into the WHERE clause of an UPDATE statement. This allows an authenticated administrator po...
CVE-2026-102569
The ClipBucket application (versions v5 through 5.5.3-#197 ) contains a time-based blind SQL injection vulnerability within the admin video edit function. The root cause is the lack of proper escaping when the videoid parameter is concatenated into an UPDATE statement. An authenticated administra...
CVE-2026-102570 ClipBucket v5 through 5.5.3-#197 SQL Injection via language_id Parameter
ClipBucket v5 through 5.5.3-197 contains a time-based blind SQL injection vulnerability in the language update function where the languageid parameter is concatenated unescaped into the WHERE clause of an UPDATE statement. An authenticated administrator with basicsettings permission can inject...
CVE-2026-102569 ClipBucket v5 through 5.5.3-#197 SQL Injection via videoid Parameter
ClipBucket v5 through 5.5.3-197 contains a time-based blind SQL injection vulnerability in the admin video edit function where the videoid parameter is concatenated into an UPDATE statement without proper escaping. An authenticated administrator with videomoderation permission can inject arbitrar...
EUVD-2026-88971
ClipBucket v5 through 5.5.3-197 contains a time-based blind SQL injection vulnerability in the language update function where the languageid parameter is concatenated unescaped into the WHERE clause of an UPDATE statement. An authenticated administrator with basicsettings permission can inject...
CVE-2026-102570 ClipBucket v5 through 5.5.3-#197 SQL Injection via language_id Parameter
ClipBucket v5 through 5.5.3-197 contains a time-based blind SQL injection vulnerability in the language update function where the languageid parameter is concatenated unescaped into the WHERE clause of an UPDATE statement. An authenticated administrator with basicsettings permission can inject...
