287232 matches found
PT-2026-107869
Name of the Vulnerable Software and Affected Versions NetBoard CRM demo platform affected versions not specified Description An issue exists in the '/module/auth/recovery.php' endpoint where the user-name POST parameter is susceptible to SQL injection. This allows for blind attacks using Boolean,...
PT-2026-117204
Summary Coraza's JSON body processor converts nested JSON properties into dot-separated ARGS POST names without escaping dots contained in literal property names. Two distinct JSON properties can therefore collapse into the same Coraza variable An unauthenticated attacker can place a malicious...
CVE-2026-107375: Improper Neutralization of Special Elements used in an SQL Command
JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request paramete...
PT-2026-108109
Name of the Vulnerable Software and Affected Versions JHipster versions 7.0.0 through 9.3.x Description Reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database are susceptible to SQL injection. The issue occurs because the sort request parameter in paginated...
PT-2026-107920
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Appsbd Vitepos vitepos-lite allows Blind SQL Injection.This issue affects Vitepos: from n/a through 3.6.1...
CVE-2026-9209: Missing Authentication for Critical Function
mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the runQueryButton postback and exportSqlQueryServer PageMethod execute caller-supplied SQL against the backing Sybase SQL Anywhere database using DBA/sysadmin...
Aruba ClearPass Policy Manager 6.11.x < 6.11.16 / 6.14.x < 6.14.1 Multiple Vulnerabilities (HPESBNW05158)
The version of Aruba ClearPass Policy Manager installed on the remote host is 6.11.x prior to 6.11.16, or 6.14.x prior to 6.14.1. It is, therefore, affected by multiple vulnerabilities as referenced in the HPESBNW05158 advisory. - Deserialization of untrusted data vulnerabilities exist in the web...
Apache OzHera 2.2.6 Authenticated SQL Injection
Summary Apache OzHeraIncubating is an Application Performance Monitoring APM platform designed for the cloud-native era. It revolves around applications and integrates capabilities such as metric monitoring, distributed tracing, logging, and alerting. The platform's mission is to enhance the onli...
EulerOS 2.0 SP15 : perl-DBI (EulerOS-SA-2026-3935)
According to the versions of the perl-DBI packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders.x000D x000D The fi...
Microsoft SQL Server Privilege Escalation
The vulnerability of the Microsoft SQL Server database management system is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow attackers to enhance their privileges remotely...
Microsoft SQL Server Privilege Escalation
The vulnerability of the Microsoft SQL Server database management system is related to deficiencies in access control mechanisms. Exploiting this vulnerability can allow an attacker to enhance their privileges remotely...
Microsoft SQL Server Buffer Overflow
The vulnerability of the Microsoft SQL Server database management system is related to overflow in the buffer of dynamic memory. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...
Microsoft SQL Server Privilege Escalation
The vulnerability of the Microsoft SQL Server database management system is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to enhance their privileges remotely...
Microsoft SQL Server Deserialization RCE
The vulnerability of the Microsoft SQL Server database management system is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...
Microsoft SQL Server Privilege Escalation
The vulnerability of the Microsoft SQL Server database management system is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to enhance their privileges remotely...
RHLW-2026-B44D1F7DAC7A0D3D Lightwell Security Advisory: postgresql 42.3.3.rhlw-00006
Red Hat Lightwell has released org.postgresql:postgresql 42.3.3.rhlw-00006 with backported fixes for CVE-2022-31197, CVE-2022-41946, CVE-2024-1597, and CVE-2026-42198. CVE-2022-31197: SQL Injection in ResultSet.refreshRow with malicious column names in pgjdbc CVE-2022-41946: TemporaryFolder on...
CVE-2026-76270
In Splunk Enterprise versions below 10.4.3, a user that holds a role with the listspl2modules capability could use SQL injection in SPL2 module filtering to access all relevant data available through the affected Representational State Transfer REST API, including private SPL2 module definitions...
CVE-2026-107352
Missing authorization checks in Amazon Athena engine version 3 request handling could have allowed an authenticated user to read limited query metadata AWS account identifiers and SQL statement text from other AWS accounts. Query results, credentials, and Amazon S3 data were not affected. AWS...
EUVD-2026-94622
In Splunk Enterprise versions below 10.4.3, a user that holds a role with the listspl2modules capability could use SQL injection in SPL2 module filtering to access all relevant data available through the affected Representational State Transfer REST API, including private SPL2 module definitions...
CVE-2026-76270 Structured Query Language (SQL) Injection in the SPL2 Module Catalog in Splunk Enterprise
In Splunk Enterprise versions below 10.4.3, a user that holds a role with the listspl2modules capability could use SQL injection in SPL2 module filtering to access all relevant data available through the affected Representational State Transfer REST API, including private SPL2 module definitions...