264427 matches found
Astra Linux – Vulnerability in Sogo
Before version 5.12.7, when PostgreSQL was used, SOGo allowed SQL injection attacks...
Astra Linux – vulnerability in PostgreSQL 11
In the extension script, a SQL injection vulnerability was found in PostgreSQL when it uses @extowner@, @extschema@, or @extschema:...@ within a quoting construct dollar quoting, '', or "". If an administrator has installed files from a vulnerable, trusted, non-bundled extension, an attacker with...
Astra Linux – vulnerability in libpgjava
The PostgreSQL JDBC Driver abbreviated as PgJDBC enables Java programs to connect to a PostgreSQL database using standard, database-independent Java code. The PGJDBC implementation of the java.sql.ResultRow.refreshRow method fails to escape column names; therefore, a malicious column name...
Astra Linux – Vulnerability in Zabbix
A low-privilege regular Zabbix user with API access can exploit the SQL injection vulnerability in the include/classes/api/CApiService.php file to execute arbitrary SQL commands using the groupBy parameter...
Astra Linux – Vulnerability in PostgresSQL 11
When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries during the initial establishment of a connection, despite the use of SSL certificate verification and encryption...
Astra Linux – Vulnerability in Apache Log4j1.2
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter, where the values to be inserted are converted using PatternLayout. The message converter %m is likely to always be included. This allows attackers to manipulate SQL statements by entering crafted...
Astra Linux – vulnerability in sogo
In SOGo versions prior to 5.12.7, when PostgreSQL or MariaDB is used and cleartext passwords are stored, SQL injection is possible. This issue is related to cpassword = '%@' in changePasswordForLogin...
Astra Linux – vulnerability in Zabbix
A non-administrator user account on the Zabbix frontend with the default User role, or with any other role that grants API access, can exploit this vulnerability. There is an SQL injection flaw in the CUser class within the addRelatedObjects function; this function is invoked via CUser.get, which...
Astra Linux – Vulnerability in OpenLDAP
In OpenLDAP 2.x versions before 2.5.12 and 2.6.x versions before 2.6.2, there is a SQL injection vulnerability in the experimental slapd backend, caused by a SQL statement within an LDAP query. This vulnerability can occur during an LDAP search operation, when the search filter is processed, due ...
WordPress FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin <= 1.7.0 - Authenticated (Administrator+) SQL Injection vulnerability
Authenticated Administrator+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin FluentCart versions = 1.7.0...
CVE-2026-53574
EspoCRM is an open source customer relationship management application. From 8.1.0 until 9.3.8, an authenticated non-administrator can submit a crafted where parameter to the GET entity streamAttachments endpoint because that query path permits complex expressions. Boolean-based blind SQL injecti...
600,000 WordPress Sites Affected by SQL Injection Vulnerability in Backuply WordPress Plugin
On September 17th, 2026, we received a submission for a Second-Order SQL Injection vulnerability in Backuply, a WordPress plugin with more than 600,000 active installations. This vulnerability makes it possible for authenticated attackers with subscriber-level access and above to store a maliciou...
Important: Red Hat Security Advisory: mariadb-connector-c security update
An update for mariadb-connector-c is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...
mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string()
A flaw was found in MariaDB server. An application processing non-validated user input, which then uses mysqlrealescapestring and sends data to the database via text protocol with the big5 character set, is vulnerable to SQL injection. This allows a remote attacker to execute malicious SQL...
CVE-2026-53574 EspoCRM: Blind SQL injection via streamAttachments where-clause complex expression
EspoCRM is an open source customer relationship management application. From 8.1.0 until 9.3.8, an authenticated non-administrator can submit a crafted where parameter to the GET entity streamAttachments endpoint because that query path permits complex expressions. Boolean-based blind SQL injecti...
EUVD-2026-102101
EspoCRM is an open source customer relationship management application. From 8.1.0 until 9.3.8, an authenticated non-administrator can submit a crafted where parameter to the GET entity streamAttachments endpoint because that query path permits complex expressions. Boolean-based blind SQL injecti...
CVE-2026-53574 EspoCRM: Blind SQL injection via streamAttachments where-clause complex expression
EspoCRM is an open source customer relationship management application. From 8.1.0 until 9.3.8, an authenticated non-administrator can submit a crafted where parameter to the GET entity streamAttachments endpoint because that query path permits complex expressions. Boolean-based blind SQL injecti...
CVE-2026-53574
The open-source customer relationship management application EspoCRM is vulnerable to a boolean-based blind SQL injection in versions 8.1.0 through 9.3.8 . The flaw exists in the GET entity streamAttachments endpoint because the query path permits complex expressions, allowing an authenticated no...
CVE-2026-53574 EspoCRM: Blind SQL injection via streamAttachments where-clause complex expression
EspoCRM is an open source customer relationship management application. From 8.1.0 until 9.3.8, an authenticated non-administrator can submit a crafted where parameter to the GET entity streamAttachments endpoint because that query path permits complex expressions. Boolean-based blind SQL injecti...
CVE-2026-53574
EspoCRM is an open source customer relationship management application. From 8.1.0 until 9.3.8, an authenticated non-administrator can submit a crafted where parameter to the GET entity streamAttachments endpoint because that query path permits complex expressions. Boolean-based blind SQL injecti...