287195 matches found
GHSA-WF65-4JJX-Q444 PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL
PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL Summary The PGVector and Cassandra knowledge-store backends validate SQL/CQL identifiers such as schema, keyspace, and collection names, but still insert the caller-controlled dimension argument directly into CREATE...
PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL
PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL Summary The PGVector and Cassandra knowledge-store backends validate SQL/CQL identifiers such as schema, keyspace, and collection names, but still insert the caller-controlled dimension argument directly into CREATE...
WordPress Tickera plugin <= 3.6.0.6 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Rasyid Abdi Gantoro in WordPress Plugin Tickera versions = 3.6.0.6...
WebAttackDetector
WebAttackDetector Static machine-learning triage for suspicio...
ProcessMaker SQL Injection Vulnerability
Versions of ProcessMaker prior to 2026.14.3 have a SQL injection vulnerability. This vulnerability stems from the unvalidated orderby parameter in the GET /api/1.0/tasks endpoint. The orderby parameter is bound to user-controlled processrequests column names, which are used in the DB::raw SQL...
Security Bulletin: Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection
Summary Multiple vulnerabilities have been addressed in the Sniffer component as part of IBM Guardium Data Protection Vulnerability Details CVEID:CVE-2026-75875 DESCRIPTION: IBM Guardium Data Protection could allow a remote attacker to execute arbitrary code due to path traversal. CWE:CWE-22:...
CVE-2026-9209
mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the runQueryButton postback and exportSqlQueryServer PageMethod execute caller-supplied SQL against the backing Sybase SQL Anywhere database using DBA/sysadmin...
sxwp2shell
/ / / / / / | |/ / \ / / / / / / / / | / / / / / / / // / / / / / // | //// ///// /////|| sxwp2shell — Pre-auth RCE exploit for WordPress via REST API batch-route confusion CVE-2026-63030 + SQL injection CVE-2026-60137. Affected: WP 6.9.0–6.9.4 / 7.0.0–7.0.1 Install git clone...
CVE-2026-9209 mJobTime 15.7.3.32 Unauthenticated SQL Execution RCE via Login.aspx
mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the runQueryButton postback and exportSqlQueryServer PageMethod execute caller-supplied SQL against the backing Sybase SQL Anywhere database using DBA/sysadmin...
EUVD-2026-95035
mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the runQueryButton postback and exportSqlQueryServer PageMethod execute caller-supplied SQL against the backing Sybase SQL Anywhere database using DBA/sysadmin...
CVE-2026-9209
Versions of mJobTime through build 15.7.3.32 are vulnerable to an unauthenticated SQL execution vulnerability within the Login.aspx admin panel handlers. Specifically, the runQueryButton postback and exportSqlQuery_Server PageMethod fail to enforce server-side authentication, relying instead on a...
CVE-2026-9209 mJobTime 15.7.3.32 Unauthenticated SQL Execution RCE via Login.aspx
mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the runQueryButton postback and exportSqlQueryServer PageMethod execute caller-supplied SQL against the backing Sybase SQL Anywhere database using DBA/sysadmin...
Exploit for Authentication Bypass Using an Alternate Path or Channel in Sangoma Freepbx
freepbx-rce-detector Triage scanner for CVE-2025-57819, t...
CVE-2026-105076
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Appsbd Vitepos vitepos-lite allows Blind SQL Injection.This issue affects Vitepos: from n/a through 3.6.1...
CVE-2026-105076 WordPress Vitepos plugin <= 3.6.1 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Appsbd Vitepos vitepos-lite allows Blind SQL Injection.This issue affects Vitepos: from n/a through 3.6.1...
CVE-2026-105076 WordPress Vitepos plugin <= 3.6.1 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Appsbd Vitepos vitepos-lite allows Blind SQL Injection.This issue affects Vitepos: from n/a through 3.6.1...
CVE-2026-105076
The Appsbd Vitepos vitepos-lite WordPress plugin is vulnerable to Blind SQL Injection in versions up to and including 3.6.1 . The root cause is the Improper Neutralization of Special Elements used in an SQL Command (CWE-89). This flaw allows an attacker to perform unauthorized database queries. N...
EUVD-2026-94942
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Appsbd Vitepos vitepos-lite allows Blind SQL Injection.This issue affects Vitepos: from n/a through 3.6.1...