EUVD-2026-58178

A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenticated actor with async query access to execute arbitrary code on Apache Spark workers by sending a crafted SQL query to the direct query endpoint...

EUVD-2019-20201

ASP-CMS contains a SQL injection vulnerability in the commentList.asp endpoint that allows unauthenticated remote attackers to inject arbitrary SQL by manipulating the id parameter in GET requests to the comment listing script. Attackers can bypass the application's keyword blocklist by...

CVE-2019-25765 ASP-CMS SQL Injection via commentList.asp id Parameter

ASP-CMS contains a SQL injection vulnerability in the commentList.asp endpoint that allows unauthenticated remote attackers to inject arbitrary SQL by manipulating the id parameter in GET requests to the comment listing script. Attackers can bypass the application's keyword blocklist by...

CVE-2019-25765 ASP-CMS SQL Injection via commentList.asp id Parameter

ASP-CMS contains a SQL injection vulnerability in the commentList.asp endpoint that allows unauthenticated remote attackers to inject arbitrary SQL by manipulating the id parameter in GET requests to the comment listing script. Attackers can bypass the application's keyword blocklist by...

CVE-2019-25765

CVE-2019-25765 describes a SQL injection in the ASP-CMS commentList.asp endpoint. The vulnerability arises from unsafely handling the id parameter in GET requests, enabling unauthenticated remote attackers to inject arbitrary SQL. Attackers can bypass the keyword blocklist by interleaving the str...

CVE-2019-25765

ASP-CMS contains a SQL injection vulnerability in the commentList.asp endpoint that allows unauthenticated remote attackers to inject arbitrary SQL by manipulating the id parameter in GET requests to the comment listing script. Attackers can bypass the application's keyword blocklist by...

CVE-2024-58374 Hongjing e-HR Unauthenticated SQL Injection via getSdutyTree

Hongjing e-HR contains an unauthenticated SQL injection vulnerability in the getSdutyTree servlet endpoint that allows remote unauthenticated attackers to access protected resources by supplying a path traversal sequence in the request URI to bypass the oauthservlet authentication filter. Attacke...

EUVD-2024-55719

Hongjing e-HR contains an unauthenticated SQL injection vulnerability in the getSdutyTree servlet endpoint that allows remote unauthenticated attackers to access protected resources by supplying a path traversal sequence in the request URI to bypass the oauthservlet authentication filter. Attacke...

CVE-2024-58374

CVE-2024-58374 involves an unauthenticated SQL injection in the getSdutyTree servlet of Hongjing e-HR. The vulnerability allows remote attackers to bypass the oauthservlet authentication filter by using a path traversal sequence in the request URI and to inject UNION-based SQL payloads through th...

CVE-2026-59109

SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in received electronic invoices. When importing a received e-invoice UBL/PEPPOL or an e-commerce export, Zalktis concatenates partner-controlled values directly into SQL statement text using string...

CVE-2026-59109

Summary: CVE-2026-59109 concerns the Zalktis accounting application, where SQL injection can be triggered via trading-partner‑controlled fields in received electronic invoices. What is affected: Zalktis before 2026.1.586 and before 2026.2.592. The issue occurs when importing a received e‑invoice ...

CVE-2026-59109 Zalktis: SQL injection via partner-controlled fields in imported e-invoices

SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in received electronic invoices. When importing a received e-invoice UBL/PEPPOL or an e-commerce export, Zalktis concatenates partner-controlled values directly into SQL statement text using string...

EUVD-2026-58133

SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in received electronic invoices. When importing a received e-invoice UBL/PEPPOL or an e-commerce export, Zalktis concatenates partner-controlled values directly into SQL statement text using string...

CVE-2026-71287

A flaw was found in Cacti. An authenticated user, regardless of their privilege level, can exploit a vulnerability where user-supplied input for sorting database columns is not properly sanitized. This allows for the injection of malicious SQL commands, leading to time-based blind SQL injection...

CVE-2026-73670

A CMS contains a SQL injection vulnerability in admin/dbdata.php at line 509 that allows authenticated administrators to inject arbitrary SQL into a SHOW COLUMNS FROM statement by supplying unsanitized input through the tablename GET or POST parameter. Attackers can perform table traversal,...

CVE-2026-19710

A vulnerability was found in SourceCodester Simple Student Information System. Affected by this vulnerability is an unknown functionality of the file app/admin/departments/viewdepartment.php. Performing a manipulation of the argument ID results in sql injection. The attack is possible to be carri...

CVE-2024-3379

creationtimestamp| type| source ---|---|--- 2026-08-13 16:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3msxzmn3vid2f...

EUVD-2026-58106

A CMS contains a SQL injection vulnerability in admin/dbdata.php at line 509 that allows authenticated administrators to inject arbitrary SQL into a SHOW COLUMNS FROM statement by supplying unsanitized input through the tablename GET or POST parameter. Attackers can perform table traversal,...

CVE-2026-73670 CMS Admin SQL Injection via db_data.php table_name Parameter

A CMS contains a SQL injection vulnerability in admin/dbdata.php at line 509 that allows authenticated administrators to inject arbitrary SQL into a SHOW COLUMNS FROM statement by supplying unsanitized input through the tablename GET or POST parameter. Attackers can perform table traversal,...

CVE-2026-73670

The CVE describes a SQL injection in a CMS affecting the admin/db_data.php component (line 509) that allows authenticated administrators to inject arbitrary SQL into a SHOW COLUMNS FROM statement via an unsanitized table_name parameter (GET/POST). Attack techniques include table traversal, time-b...